Extracted

• • Target

    6ee1acf65033f976c454076e7bfffdae7e7a0c9fa86be23d09dcec6dd2b6df02

  • Size

    255KB

  • MD5

    508f7fb1894f6b62f1be00a2f1c44599

  • SHA1

    6249464295b0424bb74726ea8148878cfb295692

  • SHA256

    6ee1acf65033f976c454076e7bfffdae7e7a0c9fa86be23d09dcec6dd2b6df02

  • SHA512

    eba6d8b0d73abff9955d7025cef7c53221a2dba3667ff199a87d3edec62e781440820026432f73e1b20353f95ab9b315b7c9d9388f2655705889ceda75d7c2ca

  • SSDEEP

    6144:iorUJvgpuP4t0XrOyc79RAU5SJu9WPBshHviRpHFO:iq64puP4tMzyRAU5Mu9WWhHvm6

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2