Extracted

• • Target

    c69e4ce48dbf378920c3a0cc37ebf881307640e541e5b9d502e67ecd14ebf7fc.exe

  • Size

    11.0MB

  • MD5

    ef3c5015763ab19adfb70ad34cc3aab4

  • SHA1

    78b17d4ecf64b54f8a60bdf831204ceea591e11d

  • SHA256

    c69e4ce48dbf378920c3a0cc37ebf881307640e541e5b9d502e67ecd14ebf7fc

  • SHA512

    eb2989667b3f052805e34022b978d258a740c83985854b5af884288bb36f8cf24564d0164153f778f92877a16c1303d3c360e70dc8128679a0b0dd0ad35e0236

  • SSDEEP

    3072:qrLSAaIXFM9X/WWIyOEfEDQMZWecFKmZv:sNWktyH9VR

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2