Extracted

• • Target

    69b4acf0e4f2fb04e24c83c233f794ea13b47e096cbbda7030c4208de84b2d69

  • Size

    10.9MB

  • MD5

    d317d5f42247781eb3a91c3ec3e334ab

  • SHA1

    ce9cc42433c12fab5af097adeac7c61317e305aa

  • SHA256

    69b4acf0e4f2fb04e24c83c233f794ea13b47e096cbbda7030c4208de84b2d69

  • SHA512

    dd810a62da01893e76cb36c510fbe52899f2b49e27b673ae99f897ccf27e5fa2b3fd6281461c35dfa743af8ea979415e12c0ffe7a8da3479f91ed7f730f7f0df

  • SSDEEP

    24576:kxtPE2gggggggggggggggggggggggggggggggggggggggggggggggggggggggggg:WtPE

  Score

  10^/10

  tofseeevasionexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2