Extracted

• • Target

    7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe

  • Size

    229KB

  • MD5

    ddb3205a92ff18ae17b3f9f93c7b197c

  • SHA1

    b77c666a2d7b1f63ba08316f9a221be6ac1f786a

  • SHA256

    7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8

  • SHA512

    db659ead4fd2ed186f221adf5bb9ab5b686253454eeb307ba247a99d8026c009d72ed11473d4622146c7b6cf59f445ad3b020ac3394d3f61af5bfd385b43c334

  • SSDEEP

    3072:lnUQviqZALXadUs0vEJimn1K29YbqYZgpLneYDR89fJ5j3UxS6MeILYS:lnUzPjflapLnsdT3U2eILY

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2