Extracted

• • Target

    89a45f8035160a57e7fa0d21064397ea

  • Size

    12.8MB

  • MD5

    89a45f8035160a57e7fa0d21064397ea

  • SHA1

    e4e0e7a4846dd31e2cf98e3cec749dc19379a313

  • SHA256

    1a20ab1e6aa6499051de55ac6c91a9349c4cfec24797cbffcde3b431e84887c6

  • SHA512

    ac28d998b51a8e646444d4d52b275e0252032f14b9b3e35e1f98debe2eb8b40c129163820874349d6c4d87c15c0cc7ed8ab9bf75fdf97dcaaddfb3ab97218e4e

  • SSDEEP

    49152:LSoyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyO:

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2