Extracted

• • Target

    59f4267dae33e83b59d952b7d5fe31bc.bin

  • Size

    14.9MB

  • MD5

    59f4267dae33e83b59d952b7d5fe31bc

  • SHA1

    d1e6de12cc46bdb05943adde0c03b4b212685efb

  • SHA256

    e000777678e885983bbbea7fc659bcf79c7c4ba38d548d3411a58347666dc92a

  • SHA512

    927ffd0a7382a54b6561c5d2dc0b948e95498f56dfa194bec4c35f18c2af45e27ed496c884a0d3702537dc50c57fcd967cadda39464e7979e6fe7715f56ee14b

  • SSDEEP

    6144:v+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:v+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2