Extracted

• • Target

    3af14f6a815a984317ed01bfe46fd4df0070bce770aaa54bc55cc626831112a5

  • Size

    12.1MB

  • MD5

    702446058f451ba7dc24f6c803c2cde0

  • SHA1

    bf3a9ba6eba9b010f73b40e14af10665468726a0

  • SHA256

    3af14f6a815a984317ed01bfe46fd4df0070bce770aaa54bc55cc626831112a5

  • SHA512

    d66c491708c746ed590d7394dd33b466bfec6e65268426af6996042335e9f256d6029f26434312bf401997d7bbba22688540d1a6066536c80894ce89b5d7ae43

  • SSDEEP

    3072:iaph+Lu/fY1fiDxf3AC0Rio+jbtocBO4Ie54I3swQ3swQ3swQ3swQ3swQ3swQ3s8:iG+Lu/fMaDNYizjbQ

  Score

  10^/10

  tofseeevasionexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2