Extracted

• • Target
    5c35fea681df97b50e0d86afc84e626b
  • Size 10.7MB
  • SHA256 3254b338c3d8a9ed898c84d8d69742d0564289eb6a8cbceb6a9de45a12e42d14
  • MD5 5c35fea681df97b50e0d86afc84e626b
  • SHA1 b8e4c53b06fafc704a2198258405184fa2735d3c
  • SHA512 d8e1a29ffdcf07ff1327bd12e031b8e4b3d9a358e490b213eb055ac9419342435370e92acd46278ca93b144b699dd300e8dda7a920a7d7273de669aaad70ed64
  • SSDEEP 49152:Rjrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr:p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2