Extracted

• • Target

    ybyrikeu.exe

  • Size

    14.6MB

  • MD5

    ca17b0424f909bdc349dc3d80afe6e7f

  • SHA1

    e158fea33819fdbb6c106c1b0a53bff446008c54

  • SHA256

    83dc7a944be536ebd5cdda86381f84235930e36be9fea78504e0a997763ace58

  • SHA512

    f2d7c03b64e2ee0ca64d1b5dc57c2bd4eb44d9b77c9e4e4cce7a6672648b6676f9f78ba5bac79733aa5cdbeb0d6bfbe5064581fd3bf4d8dc5c9b73c795b67906

  • SSDEEP

    6144:kc6OZDisWsD0Td2HJxO+m8PuG1R4WnWjrsaz:k1OZDisvwdaxO0PuG1R4CWs

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4