Extracted

• • Target

    1fde6a683afa19f2133e204b30283a29.virus

  • Size

    13.4MB

  • MD5

    1fde6a683afa19f2133e204b30283a29

  • SHA1

    e9578506ce5e793261b8eb26344d9a1c99149586

  • SHA256

    05cd14dc475523a662dd0e48e5fa5060c1e31584a88cdf0150cdae15c0611c74

  • SHA512

    4511077c0e7604d190a66a2b5609eefabf5d5db1a9c00e423ee9963c0ac6a18abe10f2fc9de87fc9bfcf07b399c5a774778d275e656282eb8bc2a4e164b1f92a

  • SSDEEP

    12288:AkcLVukCo8F8JeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMc:AkkYkCoD

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2