Extracted

• • Target
    56682ca9ad12536f6e53da6b2c02a72258996acd67b66ce1da12a16c694b2d83.exe
  • Size 13.9MB
  • SHA256 56682ca9ad12536f6e53da6b2c02a72258996acd67b66ce1da12a16c694b2d83
  • MD5 ab0e948d4784415f90d8677e5f4c9d91
  • SHA1 812b1354f35ed90d60aaa8c562db4380919f12ab
  • SHA512 a42433ffe7cfcef3c5e3db9981f93dbc1a2a7fd2269764128ac30b3750fc020249ca70a11c975c1f7cc373ab8fb032e96a5b2ae07d55edb95c841df4e740929d
  • SSDEEP 49152:1zPOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX:1D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2