Extracted

• • Target

    c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add.exe

  • Size

    12.8MB

  • MD5

    75aaf5422bdf991928937b7d656080f5

  • SHA1

    425ccba2469fc3bfad5ca0a9b5f3a1f8a6acac6c

  • SHA256

    c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add

  • SHA512

    a4e45f29c106e3c166c887d44e349940ce581ea07eed15b1f465a30ccbae470e586c9cee37de85a8dd4bf6253f07bf272fac5bf9114601a25c78865b2a75ecc2

  • SSDEEP

    49152:cN8888888888888888888888888888888888888888888888888888888888888u:0

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2