Extracted

• • Target

    938bdaad404914635b4acc4510fe1121b28c2131aeaa308783c3588e628347b3

  • Size

    213KB

  • MD5

    4b549fa8c31524128d8ad39c341adc12

  • SHA1

    8679f2cd0dc019eb40cf6adf54d033092c844fef

  • SHA256

    938bdaad404914635b4acc4510fe1121b28c2131aeaa308783c3588e628347b3

  • SHA512

    9eb6d5ab732285eb7888b4714110fdc709e48400c09a3e9c6e64caf3fec3c82b6793d8de3761f72367487552f0c7dba725345ed10998583216d46a39f99dab74

  • SSDEEP

    6144:/zDXnqPnz5H7Mh27ROOSxJ/z/MB0Vdh1GQ:/nXq/z5H7Mho38/rVdz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2