Extracted

• • Target

    489f26c346d2ff193ea6802b5c23e2bfa596960d2358d10ca70c60e590f61d3e.exe

  • Size

    307KB

  • MD5

    002577e928a32cc049a70cc3dfd32f1a

  • SHA1

    3260f1f784d1423c622b895cd8df6198c10afef2

  • SHA256

    489f26c346d2ff193ea6802b5c23e2bfa596960d2358d10ca70c60e590f61d3e

  • SHA512

    b696003b75d28c5b5004e9ad5f0d6d2d5685eccbb59935d870a222c28a10700281690df42b95ab745aaafa7c0a4987ea52d8b54792e481ba49f8af81fd86ca82

  • SSDEEP

    3072:TTUp9FKYtnJVHdc+O4vVUfF3vjS2MA7215s6pJUMu63jXdo:U5KWJVHdhftUBbVMA72E6pLjX

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2