Extracted

• • Target
    2b7385aa5abdda5bbf3da3fc48215fc837b3cd15270fc618ceac03bfb5c0ddca
  • Size 14.5MB
  • SHA256 2b7385aa5abdda5bbf3da3fc48215fc837b3cd15270fc618ceac03bfb5c0ddca
  • MD5 098f305ad80931639cbd55398fae8c4a
  • SHA1 2389c6a040ba89e89ebd0502674c8626b232c3f9
  • SHA512 611afe35a3fdf49526b6ec04a095f1fcea608b65dafd96f6e6b1d55eee5b7e3801a905620862764f91b2deb256c0a29c68da7d72ab0438421d5d5d70d8b7c3b8
  • SSDEEP 6144:DLmhaXrxJHCx7HdqAT7mvs/bNAk3B79NmVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVj:DLmhaXrxJHuHdPT1n9N
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2