Extracted

• • Target

    aedba5939122af54e928bc355fbd3ffce10cc95f8d7efd007b8f9960d3c0cfe5.exe

  • Size

    256KB

  • MD5

    11d6fdab8ce0a4462699d12d8cc6e181

  • SHA1

    f79dd773636fb0c46346f08e9a36bea666e34350

  • SHA256

    aedba5939122af54e928bc355fbd3ffce10cc95f8d7efd007b8f9960d3c0cfe5

  • SHA512

    dd582a962bc9d3c50782a528a1c635d065530b96f7e1325d0c254f299b10b29218a8626b15f18b11aaf234b7393cea39d8025fa8d023fa9e79bdbdce2d6478a6

  • SSDEEP

    3072:DlrJL/wyRvNQG+FiOf5hqBNDo0Rpv01b8FbuW5hL4WeNH601:D3L/wUkFiOf5Ybon1gL4WeNa

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2