Extracted

• • Target

    ad47fc74baa9ccd6f9b004a990b27393eba378eff2dcc7e2de3ce2b95501c7f4

  • Size

    14.1MB

  • MD5

    82af93e89cf7525040978c5a5815c123

  • SHA1

    47193983774a29f19ada610751133ed5779915ac

  • SHA256

    ad47fc74baa9ccd6f9b004a990b27393eba378eff2dcc7e2de3ce2b95501c7f4

  • SHA512

    08cfb9037aa05269f7303ddbdc522889b5486295d6a8445edc485f39d800eca682c202edf58350eb08d8b0e84c7232c6c2f94698f5951eab402c92f3d5b06d06

  • SSDEEP

    24576:0sPvIp7DpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpJ:lvY7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2