Extracted

• • Target
    ad47fc74baa9ccd6f9b004a990b27393eba378eff2dcc7e2de3ce2b95501c7f4
  • Size 14.1MB
  • SHA256 ad47fc74baa9ccd6f9b004a990b27393eba378eff2dcc7e2de3ce2b95501c7f4
  • MD5 82af93e89cf7525040978c5a5815c123
  • SHA1 47193983774a29f19ada610751133ed5779915ac
  • SHA512 08cfb9037aa05269f7303ddbdc522889b5486295d6a8445edc485f39d800eca682c202edf58350eb08d8b0e84c7232c6c2f94698f5951eab402c92f3d5b06d06
  • SSDEEP 24576:0sPvIp7DpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpbpJ:lvY7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2