Extracted

• • Target

    56682ca9ad12536f6e53da6b2c02a72258996acd67b66ce1da12a16c694b2d83.exe

  • Size

    13.9MB

  • MD5

    ab0e948d4784415f90d8677e5f4c9d91

  • SHA1

    812b1354f35ed90d60aaa8c562db4380919f12ab

  • SHA256

    56682ca9ad12536f6e53da6b2c02a72258996acd67b66ce1da12a16c694b2d83

  • SHA512

    a42433ffe7cfcef3c5e3db9981f93dbc1a2a7fd2269764128ac30b3750fc020249ca70a11c975c1f7cc373ab8fb032e96a5b2ae07d55edb95c841df4e740929d

  • SSDEEP

    49152:1zPOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX:1D

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2