Extracted

• • Target
    3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4
  • Size 10.9MB
  • SHA256 3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4
  • MD5 2f0b4b4819d48ff7ba4dbeb258a93189
  • SHA1 98067909fa21b0bf107449206405ac8b13e5c776
  • SHA512 090e957459548ed42424f07cb387664bff76d0efcc5b36943339b909290696496738c0b4586f446df4f6c0f1aa4faccb6ad66aab404a8775e7146491b4cd16e1
  • SSDEEP 6144:HLmhaXrxJHCx7HdqAT7mvs/bNAk3B79NmVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV1:HLmhaXrxJHuHdPT1n9N
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2