Extracted

• • Target

    ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

  • Size

    14.3MB

  • MD5

    2d357e20218ecce7a188d34e2163ac1c

  • SHA1

    1a5bf816db5c146b3b685fdb28c3761608fdfef4

  • SHA256

    ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

  • SHA512

    59d6d72c15003acd59936ad400a1d1d465c1d109e9c7360f14603c709679e1fddabfae87252fbb0829fad05fa668deca594715d4775bb2fa9b04af776a7fb182

  • SSDEEP

    6144:uM0Em6Qk5N3Sccccccccccccccccccccccccccccccccccccccccccccccccccc8:oEma

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2