Extracted

• • Target

    b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe

  • Size

    229KB

  • MD5

    68502dbaf73be1eca888f78e3b06d55a

  • SHA1

    14654e87e085e07b91535c7e4e8bc5f41ced65e4

  • SHA256

    b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992

  • SHA512

    d87cad3ac8f7f18cb12e63c9bb6a74f29dabf09d5374c64d51ce7a1b3621fd65e454ecf6ff0d0551b80685117b450abf50494b669ad48d5a9906b44e7364d6cb

  • SSDEEP

    3072:+nBlv1nZAbXsdUs0vEJier1K2x5b2CZ/P20DMb9rAn5M23R8Gj7mkg+cmH:+nBXk1fmK+G0DMb9rA6Gj7mkHco

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2