Extracted

• • Target

    c0885dffa6bd3706a5ee2830fa6334fa.bin

  • Size

    12.6MB

  • MD5

    c0885dffa6bd3706a5ee2830fa6334fa

  • SHA1

    e140d9b206994b584e86b2656f5aa7612e372f75

  • SHA256

    26de0928d2adea856977192abe81d2777ea2a0814dfdecad619376ed669c3ae2

  • SHA512

    3e6c3fbd063288d4ce73fe81d1cf9cf48bd8744f408600e630cd2528ccb80cf3bf39574fcdd34f05fbf282dc41fada64f3bde0f4533b5c6c9bf55793a4d7f9f5

  • SSDEEP

    6144:7+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:7+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2