Extracted

• • Target

    76ede4f29dbd8a75b643e46cabd369ac888b8012630b8b244e08e0baac8535e6

  • Size

    10.3MB

  • MD5

    81f79ce05d962b7d8b0d4977aead32df

  • SHA1

    e24b156a6ab8da34f07f67256cfacf1495a5eaec

  • SHA256

    76ede4f29dbd8a75b643e46cabd369ac888b8012630b8b244e08e0baac8535e6

  • SHA512

    710719709d2a5b78b862981cc186b2b8ad7d0654f000e5af41ad7a61af438f3be4ac8cd752740fd4ccb1bf146cf1975beb00aadd921054ce367ee87db099c0b1

  • SSDEEP

    6144:+5VCb4QuzF2tpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz7:48NKF6p

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1