Extracted

• • Target

    eb337a3207ee729da109a3d4d4e33be246d28739d7641aab00b4e945d05bebd6

  • Size

    183KB

  • MD5

    ed811dad14636a79c920a2d2cb1ec86d

  • SHA1

    50760c4737b74990413fd2facb197482a8ce9f7d

  • SHA256

    eb337a3207ee729da109a3d4d4e33be246d28739d7641aab00b4e945d05bebd6

  • SHA512

    4ee8d63adcb3bc266341848b6e27fc016a1ed9cd81865601a17fd6aeafb064b12b74e6da36cb92ffe4f20685436b97b92e03450279ef6bbbb76f9be297e13c3a

  • SSDEEP

    3072:i7QK+RkpwAtmsNNCIFzEhpwC33IH+lgpfrVggjcGkNIVqIF:FRkpwAtmsNNVyMx7ITsq

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2