Extracted

• • Target

    rdmazvej.exe

  • Size

    11.3MB

  • MD5

    b6908bd53df503767bfc98eb0b281382

  • SHA1

    0a2aaa2ad62972b3f0f73c8ef06c61fefe2c2119

  • SHA256

    27a2ca5daecccc99348be56dc60c72643b9c36eb3fc3f09b517893b157dd314c

  • SHA512

    5197ff588c0ec36150b1ae1dcd337c2848e568d4449b8f7f2d827ac30ad0bf8140a0bb68682bbde55eeb2a889eb07e14013f2302ab88cd72c2099c5d150d1cfe

  • SSDEEP

    6144:2w0VDy74AW/47pwSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSn:2w0VD7AW/49

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2