Extracted

• • Target

    7e201f6d24fb8268d2e4ba7d0e2b3e67

  • Size

    11.7MB

  • MD5

    7e201f6d24fb8268d2e4ba7d0e2b3e67

  • SHA1

    e443a234b26eac5eb753af89b35898799801c717

  • SHA256

    cb69feca957e765d0dd33ba69c7e17266641ead5805fb04f6d84232b6b796bf9

  • SHA512

    e1d1e191cd7fe8a02c2df7c68763f6245a8126eae1814522eac220834cec4230a76af476cb3cba5e8f0c89c4bab97309a00fe6eb02e3f0f269bdf211d89e28ae

  • SSDEEP

    3072:uBNmFjaoPAa5LqiM8h2pj3gKTf8dl4ghaF5+P9H:CwjaoB5LqiLh+j3gMfTCBl

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2