Extracted

• • Target

    dd74a7e347d234599ba9a11fbd4d16a26a8f433c386cd30979938c8c039c4cfa

  • Size

    13.3MB

  • MD5

    45458daf16a9f56222038e23cd8665f9

  • SHA1

    c0880db345e5f94e5408707e7b495ab00ff6dc8c

  • SHA256

    dd74a7e347d234599ba9a11fbd4d16a26a8f433c386cd30979938c8c039c4cfa

  • SHA512

    f0154db0bca16aae19094f7f0236d91b4d49824b1a56c60bea75a19b9633490a578279eb290254c78ecbffa720c6dcdac191af34d1a2e6db046a95d292715231

  • SSDEEP

    98304:dY3333333333333333333333333333333333333333333333333333333333333H:d

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2