Extracted

• • Target

    8e89363cc4699cf8b0cafdc315b3f7812bdfaed7d08fc12405d57819a578c409.exe

  • Size

    12.2MB

  • MD5

    6d34bacd46809e859bff58500bf02794

  • SHA1

    a75d1bcc9dda02dd6bb8dd886d626bdc88d5195d

  • SHA256

    8e89363cc4699cf8b0cafdc315b3f7812bdfaed7d08fc12405d57819a578c409

  • SHA512

    61636f313ebeabd34cc4d320a2efe23d45c8c7118da83d96800d7cdeffcd23495cbf7a5a018204c9b16d58a9e9d6b644ce18e7680cfb6f8122d49924d65be3f9

  • SSDEEP

    6144:d9fvApQ0bA3aGmYv+943cj9G+LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLW:d9fvApQ0bjGme84Mj90

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2