Extracted

• • Target

    de2f8364ba3eec3963be343dbe4483357092b80173664702d0bb9069c8a7da08.exe

  • Size

    10.6MB

  • MD5

    599879f0d1c0cd8dbab720e9b8b9f963

  • SHA1

    af7e923a872f9480fa8880e13684bf5a8dcf3db3

  • SHA256

    de2f8364ba3eec3963be343dbe4483357092b80173664702d0bb9069c8a7da08

  • SHA512

    09a5a69e59f4f23b9be160da9d8d6eb87e594ce100acddf0d968d7c4600fdf9ca96b90df7add41fc8607f4fee357176d45b5b7c0dcdbda9d4572f8b4a6c605fb

  • SSDEEP

    6144:jeaRFeYiZtnsLs/Xyihb124uKPoifbY/3sGIU5N5Z:jF7/iZtRXpu3ijwf5TZ

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2