Extracted

• • Target

    b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936

  • Size

    11.1MB

  • MD5

    19ac32a44156aca36e14ad44a9a5e1c2

  • SHA1

    900669e5aea78afc93bb894ac5d99066d7f21ad3

  • SHA256

    b3c1e9f75d14351aa6d078525ed891bbefdf29c0a609efa9ebd9db997c455936

  • SHA512

    461426485f7337a776f9ff8a47b27aa079507d61c6222fc035a7402c5647dac4331f0c3f1e25d229e42bd7fca5c134980c499e0db81607f695f964d0ce5f6648

  • SSDEEP

    6144:zdVCxKg+IFppIHzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzD:B85tFpp

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2