Extracted

• • Target

    466a5771af26f4655cb6cfcf5616aa2acc11c58226bf440a7d0bb29f3a88968c.exe

  • Size

    317KB

  • MD5

    8cc6aec77fca66fc44286a1519bae1ee

  • SHA1

    35b395341b0b103bf511d653b05921dc89370a65

  • SHA256

    466a5771af26f4655cb6cfcf5616aa2acc11c58226bf440a7d0bb29f3a88968c

  • SHA512

    de7e960bd1204ef301828d970764e2161cef622d529db3f8f3b001656ed01dc9d890b6e9ef385ebf0f57187fb9c62c064b8804d800a685dec9fa715fcfe3bd51

  • SSDEEP

    6144:03BH8F8MzN7YBmGXZrNcyzpulx2x1dmv56:0xH8OMzWBLZ+yzQ3srW4

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2