Extracted

• • Target

    61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa

  • Size

    292KB

  • MD5

    cd2867400d86adf084a13deec86d2c39

  • SHA1

    92263b1eef5d2e25cfb0c5060f3b9e25cd69779f

  • SHA256

    61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa

  • SHA512

    3b6225ea43362c8c468f3bf37cd2365ae447efe7c1a347504ef10aeead0e0c602f5bae3270efe738ee82630880a4b8637904c484eabd85eb22670764f4479d4b

  • SSDEEP

    3072:Aw2bSHEENJRNgwkvXKATeyRhJLcXm65tz3CnfBpg23ic9gvL4Z:L2bNWJRz2Xnh+H5t7CnJp7uj4

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2