Extracted

• • Target
    528785c4b432b56e5981a04c02cd9196
  • Size 324KB
  • SHA256 3d26d7945dfd585794694aad848b1f47e1cb538a2926f49eb06752de44cba8c0
  • MD5 528785c4b432b56e5981a04c02cd9196
  • SHA1 0cd589f194ce10afb22414c0da7c098e02317fca
  • SHA512 612635fa4b7307e1417070254a0df54b4b8f1775e839a59f30b0a35963c9ffc2b2afbc8d087947e014b10204d61cb68da3fdd9698794f05fc820f61d1d710d1e
  • SSDEEP 6144:1klWoo9zHeW6bL4G+105jK5Q5eLRriDvIY:jB9zHI0G+1OD5eLRriDvv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2