Extracted

• • Target

    04594d5a85f6667c27f9667295841af5f9893f20e74ddd23dc156d63b7aa95cd.exe

  • Size

    14.9MB

  • MD5

    f757a10679f8aedd434b42cbf4bd0059

  • SHA1

    2225607c93de06054c8321c098f192de5314f5c4

  • SHA256

    04594d5a85f6667c27f9667295841af5f9893f20e74ddd23dc156d63b7aa95cd

  • SHA512

    da964e6fdfd5a17b3733abae3bd94d33d1662a728c1441ed7fc04aa0415f3105b1897e2b6e644d855680e08d4498a3b57c16f8a0892f7a7e79159eb8903c5e91

  • SSDEEP

    49152:FkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHl:y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2