Extracted

• • Target

    7e01e488c93d766a58b2b7d7f579dd3f

  • Size

    11.9MB

  • MD5

    7e01e488c93d766a58b2b7d7f579dd3f

  • SHA1

    eeffcf7346947bf914e1b599ba8b137668e832f0

  • SHA256

    3d5fb8acee39bc003bba08f4dfdbfe0708a8672876e965d4c224947a451471e1

  • SHA512

    1b7bb22372cc60a8a55c9241d660d2ece1c01379a21b44e32a55121d7b5ad20857a3be5bdd7ba65aa675b7c40e09dfe1edc8bd7026d2f84182054e8d31509ad1

  • SSDEEP

    24576:9jY+lg48SlJPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPH:oHSl

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2