Extracted

• • Target

    6c2b21f0366b3942ae23d428155856a3deedccf6dcd00f3e27652a625455367d.exe

  • Size

    13.9MB

  • MD5

    38497df5caa858a3e65f3946bb0e28bf

  • SHA1

    2446e498831b099bc15c37c295387e1c049fc702

  • SHA256

    6c2b21f0366b3942ae23d428155856a3deedccf6dcd00f3e27652a625455367d

  • SHA512

    a172f7b7b005a72069cab497a0b3dfb79badf1b899e990c959eb0b830db4a91250c137e8e5fdf74920ca59a2ede93de39a7f85b774fe7342c1f228ab4b15bf86

  • SSDEEP

    12288:KzpKS0FRvqPKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKn:oMS

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2