Extracted

• • Target

    2024092155677129c3ec9b078fca74e0042b7667mafia

  • Size

    12.0MB

  • MD5

    55677129c3ec9b078fca74e0042b7667

  • SHA1

    0f316608d3481f66b6be8defcee658022220bb61

  • SHA256

    9242bfe755391afaabf0437648bd1d1219bfe22a3a9cc38aa400b8e586207d8e

  • SHA512

    ce397f4fdc64387094fba86c9a10c487dbf66a88e15e0aaf19cc98eec28f8e8b3b7b0ec2a5816b39f1524609636457a5ab719dfb9affd2904eb317e0eb8d24fe

  • SSDEEP

    6144:c+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:c+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2