Extracted

• • Target

    e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053.exe

  • Size

    312KB

  • MD5

    2b41691ddeb229f6f01acd6f557cc319

  • SHA1

    104ec7b54ccd78b246fda9fd6cb73126f900dd96

  • SHA256

    e3cb143065ee2414007182694ceedcba541b748825eeae851eb395a24bd08053

  • SHA512

    f93a8141e145b21c1d07a93daa7685ff5916750d49119b3d1b5fbdc3e5727f1e7f7b0918a77d7ec49a3f8b478fe018bd1f0880c264a60e25b424d9abcb24698d

  • SSDEEP

    6144:pEE79GITkewAx4JkbdmdT7xJCsUuBT9p69a:pFGekTAx42h8TrCMB5II

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2