Extracted

• • Target

    204063581a5aac527fc0be421097ddc37b338cedced74ca6858f88f3d31bcc51.exe

  • Size

    303KB

  • MD5

    09e86355c9c595720b5a6154426c9910

  • SHA1

    83b66aaab60f02c75b43ce10e5b77ba87646e2e7

  • SHA256

    204063581a5aac527fc0be421097ddc37b338cedced74ca6858f88f3d31bcc51

  • SHA512

    4072e6ee0e6535ea9787ca8e38061bf72a9c962f1018117beb5c1869e7c7ca74272e6f7dd7f326fe93ced3f8eee44a59ed7330691ab67b709e2601610a29693b

  • SSDEEP

    6144:H8prBAyFXYy/6LDrWvzVYWMsfKaA9Vpwpp69a:Hi0y/6LDiuWMSFeCII

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2