Extracted

• • Target
    dd2449cc99a8ebb87ee86c1500f97a41
  • Size 14.4MB
  • SHA256 6a7b41efa4831599f18fc65fef165a9fd49aa3210eb715a6253487d2bc7572dd
  • MD5 dd2449cc99a8ebb87ee86c1500f97a41
  • SHA1 d380615538d78ce99b7ce40a2ee73cb97d57941e
  • SHA512 10ffbe4054a0cf2b51442daf023649ee47858a5dca0b116b6b999635feb1b83d4428fdd2bf6a3b36d7fd5ec2005e1a4d7a4263715a344b9d1293b3fcf73cd7af
  • SSDEEP 24576:FjY+lg48SlJPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPH:gHSl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2