Extracted

• • Target

    a58c26dd8d015d4e3b081b09c3b21f1cff71e42abe545d90872c2eef003d51c9.exe

  • Size

    310KB

  • MD5

    b2de784471ee083a4a7e2d6f3057e00c

  • SHA1

    03e5e0fd35a1eba05ddb6d0c4f4a9d8c8d4c67a3

  • SHA256

    a58c26dd8d015d4e3b081b09c3b21f1cff71e42abe545d90872c2eef003d51c9

  • SHA512

    5aa37e1305403375b475df3abb5cb60aa6ae4e2f5f07b4d45828c67ef7591e931b7155e135d4898dc982404042dfaa7adb02f9fd12a8336b9cd30955f08125fb

  • SSDEEP

    3072:iPlmU+ROj7FN7oY9hjFJBqqKjOyTpZHNBmN+tTJfNr+1QbSoymwTTuB:iPX+RAxoYzMF5TpZtBmwG0SdTy

  Score

  10^/10

  tofseeevasionexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2