Extracted

• • Target

    8fbf1b90065fb573bbd6e2667a6e8fc4

  • Size

    10.7MB

  • MD5

    8fbf1b90065fb573bbd6e2667a6e8fc4

  • SHA1

    bc994305bd0e55ba9792e458ebcdfb0ba757933c

  • SHA256

    cd76ebe891fa6740e9f3810ceacc155d07c501d7d57784c0ab2c8c95b227e203

  • SHA512

    9717bd0e87e46ab16670297dc90093faa2b32fd935f7d6e375be1d03573cab823a7d2626a6e55147d0b6a8fe15d79f51d9a109daac136335d6c083554a5bed98

  • SSDEEP

    24576:lnzjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj:l

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2