Extracted

• • Target
    77ac2b9604d89716061ef9874c44de4772172378b46d63886db0f55800feeb32N.exe
  • Size 71KB
  • SHA256 77ac2b9604d89716061ef9874c44de4772172378b46d63886db0f55800feeb32
  • MD5 5998ae6f6db418940a38ed466256e490
  • SHA1 e37a169800217c49f3cb40d07e7caaedb4a6996f
  • SHA512 09faa0a92cacc3154620e85099ff3bd8f4765786a6346a1d9ee9af8ab75e18e4c12d2ac739c2419d541abfbe50f2c01c6a6c56f4d54bf0d9b9b0b4967ed73c07
  • SSDEEP 1536:Dkes21VCy1nTxSYg3CXTjFWL9idpIHUc:DDVCyFxSYACXF7pI0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2