Extracted

• • Target

    755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9.exe

  • Size

    203KB

  • MD5

    d88f7c78b3be6c96c33b80a8e1bb85de

  • SHA1

    ce07fb26b0ec69cdf563f98560aa4f7f298e6e8d

  • SHA256

    755b1b45c26d282f094d504074bbdf897f6460968db67dd7d88a4702e03ef7f9

  • SHA512

    1c396a26da383d01ddc317bc4c565c5825b0e452bcf262ac849cd720acb6cb7abcc08e895041e59246dd7686e72424990728745716815a5879bce30769e3e898

  • SSDEEP

    3072:Ef3B/ALaZdXUNc8iirJiM21K7uSbrF068c0E0rBNWRDxlH+cmH:Ef32clVO598c0EHxQco

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2