Extracted

• • Target

    786f5910ef3eb2b58bc6795067a0ee8f7a318bc09354e167220c81712087a007

  • Size

    312KB

  • MD5

    62b75bff0859e20c5a8a2ec94ec1ebdc

  • SHA1

    2385c826549d8e526229e081173ec54fb9498be0

  • SHA256

    786f5910ef3eb2b58bc6795067a0ee8f7a318bc09354e167220c81712087a007

  • SHA512

    1f056472c5d90b791af941ba97d252c7f4c7aee1a95128e273be7e4f41445321707a478f64c0e1e209bea6f666662e1a82e315a01c777f0308015d416c18f0e4

  • SSDEEP

    3072:zk0/LshkyJORLxH6dgiOxO2IYDWxT7qwA3OEQf9ltLCWrxpzbgqruJnfed:Q0/LsnORGhrxTqrKeuzbgwuJG

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2