Extracted

• • Target

    2593f55632b67e0b175337f44719e487b6f79c8ef46a06f10547ae71e6c63889.exe

  • Size

    10.1MB

  • MD5

    0e5a9c35b3d357763c7a52db54daf211

  • SHA1

    65bd31bc2fc54a359e9eb1a7abb03bc71d2e7c2b

  • SHA256

    2593f55632b67e0b175337f44719e487b6f79c8ef46a06f10547ae71e6c63889

  • SHA512

    3ec7ba172ed8fe2e9edd0c024b92ff00a9deb619ea16cff28ff7a49eacbd0b9139c03103da2d163d1305221b5016f181dd871cebdce75bfd9fed8586486e1520

  • SSDEEP

    49152:pkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH/:q

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2