Extracted

• • Target

    97d23550ec191ff048c89ae23e9ef5ae009ff65d79e2f286029ac90331bc90ba

  • Size

    281KB

  • MD5

    3a9ef0bc05952c74715b6585f97c41f6

  • SHA1

    877fa1694843c5bf3f5124e8b17ead26bc211c13

  • SHA256

    97d23550ec191ff048c89ae23e9ef5ae009ff65d79e2f286029ac90331bc90ba

  • SHA512

    2d67f3d29359ff2cdd058f6526e22604cf69f7126f09a0006fa8a34a90db0ac6d895cd78b5e570789d79584101add9e5ac732473d7e4cca5a9b8fee2262c2034

  • SSDEEP

    6144:YTCpFumdDpw7jmzwdJ+nY6eYqX7tNfVXVHQLIiu8cfo0/pW:YTkFugpn2UxwZGEX8cA0/M

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2