Extracted

• • Target

    b93a47f6924dbe4309eb656760e3edeafdd38061e8ef9add06598f95871260b6

  • Size

    12.9MB

  • MD5

    92017ee762ffecb801be76e272ef66b5

  • SHA1

    0171f93700ce9e398725ad857e7384031581846e

  • SHA256

    b93a47f6924dbe4309eb656760e3edeafdd38061e8ef9add06598f95871260b6

  • SHA512

    1701ed30435153b4b765775aeb68dd1e0751ef2cbc14e7016bcda1933060d881fdeb0a9145e527e29a98bcd3caec23433563d6af73babd3ce33c13242d258d75

  • SSDEEP

    12288:BZwvqm0loTlEUKg7/ua4FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXn:BSvqmNB/d

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2