Extracted

• • Target
    de2f8364ba3eec3963be343dbe4483357092b80173664702d0bb9069c8a7da08.exe
  • Size 10.6MB
  • SHA256 de2f8364ba3eec3963be343dbe4483357092b80173664702d0bb9069c8a7da08
  • MD5 599879f0d1c0cd8dbab720e9b8b9f963
  • SHA1 af7e923a872f9480fa8880e13684bf5a8dcf3db3
  • SHA512 09a5a69e59f4f23b9be160da9d8d6eb87e594ce100acddf0d968d7c4600fdf9ca96b90df7add41fc8607f4fee357176d45b5b7c0dcdbda9d4572f8b4a6c605fb
  • SSDEEP 6144:jeaRFeYiZtnsLs/Xyihb124uKPoifbY/3sGIU5N5Z:jF7/iZtRXpu3ijwf5TZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2