Extracted

• • Target

    61bda36a3ecfcd82c3c356293325a3f23657ed11311d231c8b27d37802b2d19f

  • Size

    296KB

  • MD5

    a45f8ebd25b0e3b38b47b55946f2be0d

  • SHA1

    357a124c0d3c1febbda25cff5ecec3c2f1818ea5

  • SHA256

    61bda36a3ecfcd82c3c356293325a3f23657ed11311d231c8b27d37802b2d19f

  • SHA512

    10b819067ada2b0f1ce59b75d6f71866677d4677cf3537ed28979d66569f75286862c36cf09df8740cf21fdd548714edac5229888f2774874df818a3f2bae6df

  • SSDEEP

    6144:AMYU+cI16IZX2ZFDDvT8iiX3P2uzbgwu:zYf16iG3EiiXeunn

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2