Extracted

• • Target

    4c09c870971edffb8a06d14f0789d17f51522c5df43af48fe14ee926cf721354.exe

  • Size

    220KB

  • MD5

    06d5f0ada968c0a1640846c8023e9ee9

  • SHA1

    961c48464fc79febeca7994b80369004b87bc34b

  • SHA256

    4c09c870971edffb8a06d14f0789d17f51522c5df43af48fe14ee926cf721354

  • SHA512

    dcb31fd9a44b6216da80482db6d3ebc0ae76bd3679b6c243cb65aa06c359b3ec7a89dca9f9cf3f3387e1c51a0ba1042382304eb19ddfacc1c22b92be18abe6f8

  • SSDEEP

    6144:Vb/qTWJpjKTI1rFeB4jsVSfnLqS5ICk1hcGP:JxJtKTIpEBc6fP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2