Extracted

• • Target

    932ba2f5b02919626625a80b1853c40b664c5e19aa5a43dbaf4825e6ff84d8a0

  • Size

    334KB

  • MD5

    db961867695b25febb937fcf6b3595eb

  • SHA1

    583659154883a51674224ffec8cfb9df68fac90b

  • SHA256

    932ba2f5b02919626625a80b1853c40b664c5e19aa5a43dbaf4825e6ff84d8a0

  • SHA512

    f19079147170f3615bd67724b1a179a2c0eb259ca9343990573bdf54226548f611136228bc989d793c91a16bc637665663869037a24277cb361c7087bcafbf40

  • SSDEEP

    6144:PrqoF5nyBcVI7ivrWNjDyYegF90xu2VqUGN1k6ELv1rXV:VnPprWhDyY7F9Mu2Vqfwr

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2