Extracted

• • Target

    04ec244112b44e9592f9c5e45ab50e67e402f0704d8121678afe46117de90482.exe

  • Size

    233KB

  • MD5

    f81a2c93c44bfec11cdd55eb53dde5df

  • SHA1

    45cb3d7066113e86fff081e309265a797af0ef51

  • SHA256

    04ec244112b44e9592f9c5e45ab50e67e402f0704d8121678afe46117de90482

  • SHA512

    c9fc2a6239235aa0bf24e700665666c8500000bcc76dc8e26922f8cfc0f961949bf7fa04bf9877ea3254b9a5879752d1b3f75d945318c246770b507bc0b0199e

  • SSDEEP

    3072:LefNGJ/ceeYkb2BNog9oADOF4t0wC0NnpXIpKjVEqLDOO7n+MnIitmjXO9ZJwVQk:Le1GM+NobFm0wC0NpYpuVEqSFOTF

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2