Extracted

• • Target
    2024092155677129c3ec9b078fca74e0042b7667mafia
  • Size 12.0MB
  • SHA256 9242bfe755391afaabf0437648bd1d1219bfe22a3a9cc38aa400b8e586207d8e
  • MD5 55677129c3ec9b078fca74e0042b7667
  • SHA1 0f316608d3481f66b6be8defcee658022220bb61
  • SHA512 ce397f4fdc64387094fba86c9a10c487dbf66a88e15e0aaf19cc98eec28f8e8b3b7b0ec2a5816b39f1524609636457a5ab719dfb9affd2904eb317e0eb8d24fe
  • SSDEEP 6144:c+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:c+r1IeSXMXc7LlxWV4Ug97GZ+ej
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2