Extracted

• • Target

    tofsee.exe

  • Size

    12.3MB

  • MD5

    25d2b9e890383de8e4c54531aec432dd

  • SHA1

    ccaa3021da481652aa28104eeb8af59a2ebb7ac7

  • SHA256

    50c458863b680d4b1c852fe9b6367c9a1fd6008ba4bd149f08ea71c8b06c2cb6

  • SHA512

    452991b58c1ef0d52f1971771a4fe01ce85dee5ee23d59adfdec703df4f5ec76a691fd6b4d3cd88a93736c14a886bd1df8825360efad8e2c99595dc4a4d3feb4

  • SSDEEP

    6144:peeISXLAQ4G5g0RVOppo6xI4JbDva0uRjMgUgWWWWWWWWWWWWWWWWWWWWWWWWWWn:pzbXMG5goCfDva5RQg

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2