Extracted

• • Target

    bf287ab183c3ca2038a1a683c75aa0942a0dfdd760e184b25d506d7d48614d7a.exe

  • Size

    11.9MB

  • MD5

    94ddf26483c2d2314510988223e8a8f3

  • SHA1

    e1307d39c80be583ff7fbefd99bbc6c6f41ef44a

  • SHA256

    bf287ab183c3ca2038a1a683c75aa0942a0dfdd760e184b25d506d7d48614d7a

  • SHA512

    3167dee1764a4840b70fa30d51fdc4283cfe5c7c1a84c5560e2b0e59f2b349791b681369e9047733a51a76cd2e1a28a01c540e2c71ea54279b2f6bb9950473c7

  • SSDEEP

    49152:tkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHV:K

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2