Extracted

• • Target

    bf1da149d7e5da9a8a4908039856414e838db0a32129dcad45b6c737ec92d408.exe

  • Size

    290KB

  • MD5

    d2bf0c77c70900657d7c919282b90136

  • SHA1

    dc50e45c6aabad5b672af625f5449a0f50a36116

  • SHA256

    bf1da149d7e5da9a8a4908039856414e838db0a32129dcad45b6c737ec92d408

  • SHA512

    aee9a3d7862c25205432c39e61517d2d191a067dc2da79a627c6d228875cf32960d8cbe041d51ed0cf585ffe8b030f30b0e6df49653babb2967c5f4c49febab1

  • SSDEEP

    6144:j7ol2UY55+0U4C/yHwyHkXdfLhBbjLp6:j80+0U4C6GXLBbI

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2