Extracted

• • Target

    8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1.exe

  • Size

    331KB

  • MD5

    3424a650d03640ec89fbb499d6674480

  • SHA1

    1ea36d7a77ec67039e67f944280dfdcdf1582991

  • SHA256

    8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1

  • SHA512

    5f8bed9cf3da89216af3b87d580535a29a67a617b8bee82e448ae2d02f4cf38975058d2a0d02cf3d48411745a8fc19d09eb5936b66d7be1c75d31087142e2411

  • SSDEEP

    6144:/K6gQvvYlQo7wU9TZlSmHgafhoeyz5xYmX/M:C5QvvYlhbCmHgGhoeYxYmE

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2