Extracted

• • Target

    30205eaf6f581036262bfc099dfc5cc5d0e4d771dca3d1c4cf3dada59d097672.exe

  • Size

    240KB

  • MD5

    5c1b720ec28a3d4af24a19003fb56f50

  • SHA1

    fa8c1236c3e7bc4d002be0abf5523659bf4c9af8

  • SHA256

    30205eaf6f581036262bfc099dfc5cc5d0e4d771dca3d1c4cf3dada59d097672

  • SHA512

    178e4b5633b1c4d455555b394940d6b240dc4da22e621e6c91035870f3e275b25881ea712fc7b73a4e73d9d9376045834fb00b3d03454616d877ecd3cd91790c

  • SSDEEP

    3072:JQT/QLtwugcvGMI9+x7alYjt8T/NOOZ/M5l/evBr+jL+0geRp:JE/QLXgSh7aSjtGZ/M5lP3ge

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2