Extracted

• • Target

    75e5182964f42c0b0761107ea401338d

  • Size

    10.5MB

  • MD5

    75e5182964f42c0b0761107ea401338d

  • SHA1

    1095924492b72640c229e9712b69fdbb94681d8e

  • SHA256

    4cac9e3b3d8e0446cbbe43456e8b44bf8b4cd0ac99f9c00552904c623fb03e3c

  • SHA512

    3230af9491cfee8a4358ba465f928d18b3c9c869af36501eaf228b6f6d15c0cd380609254ce12e4ef2585fd2828e31b4e626fea11b33b23bf45a66f2a3fc6b0a

  • SSDEEP

    98304:ivjOF//////////////////////////////////////////////////////////H:0

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2