Extracted

• • Target

    c2b8e0ef3f2ddad7e0edff304c92d986

  • Size

    14.9MB

  • MD5

    c2b8e0ef3f2ddad7e0edff304c92d986

  • SHA1

    bab792cc2b8f2a9fa8e50f0b285734a401d6e1e2

  • SHA256

    01ee9d3baaf4777dd7fa9a5e6bcb7848543283f7acedcc7a1e7fbba3b31be76d

  • SHA512

    ebb9bbda87f67a3fa6e725df671353af0eb9eb17b180f46a55d3b36d1023c9c8715ff0257a2277bfa8b9440adda850086eab2d654dfa2e391f40c2bf0fcde0a2

  • SSDEEP

    24576:qgdy5yNM44444444444444444444444444444444444444444444444444444440:

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2