Extracted

• • Target

    0a00671012b4cc6d328abe79ae061427f25595a5996d78dba6522d13abb23647.exe

  • Size

    10.7MB

  • MD5

    27d42e4a1a5137d5a8171fa0998feff6

  • SHA1

    c286cbcc0c3840a5c086016a9f432acdb2466bf5

  • SHA256

    0a00671012b4cc6d328abe79ae061427f25595a5996d78dba6522d13abb23647

  • SHA512

    2df5b37a8d89a632b780c2e01c0407216b66e2c9495b55d5fb7f984d6eaad409d2a1cc1f6c25f4c26b7e0c13cc89731d0f7baef1f781da642e31cea358c422db

  • SSDEEP

    3072:WcSKLbut7BWLMcD/FHNKZuKqtyONJvq4H6gGIvuFHrHtIxJXA4/a9t/a9t/a9t/6:gKHOWwe/RNKkK0vNdq4HZG0Wr2u

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2