Extracted

• • Target

    R4UBC5O.exe

  • Size

    208KB

  • MD5

    40f7ef5677b0ab00743c0a66b2d9c96a

  • SHA1

    a3b64e7d2731a21d9b574ab3f3a804474d5ce3ff

  • SHA256

    eb841ffe2d0c66d018d4d53b6a787a61c405c28def7bed3274814dddf793ae4a

  • SHA512

    9d8fd1de044f8bb399d6b6003abb573ecf00bfc270fa4d2c19f1d97d3dbc040557acf838e4673d5b859817aa9e76d008a5ac999320ee2b0ded409fe7de624689

  • SSDEEP

    3072:wZ4mW1Q1X5y/62wLAebhfcZsPj9w1RBeg8+/yGNV:i4ZA5862w79kZYkRBeA

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2