Extracted

• • Target

    aqsfwoz.exe

  • Size

    11.8MB

  • MD5

    07f1415abcdb3eb7169afb3d85d9dae5

  • SHA1

    b44b0e5a810ce27106fb31a4f955210210c53929

  • SHA256

    256663a3854aa83f75a6ead0fdf1668833e9abe83a863f09544b7a7e71764414

  • SHA512

    6bf34ded56adba5af36256039e69f0157c344b99dbb4689325b6e55c4f1172a70fda4c7adcb2c908e402f91145722207aa01551dde93121289ccb49d2c48f447

  • SSDEEP

    6144:Mw0VDy74AW/47pwSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS:Mw0VD7AW/49

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2