Extracted

• • Target
    250428-ajksdaxps5.bin.exe
  • Size 14.5MB
  • SHA256 cbcec0d3e8f866366c001b3e6a67b418cd4292a5e69cba7047a653a67bbf31c5
  • MD5 83de57a5e6d79599fe8a69cca5bb812f
  • SHA1 d151134767ef9f387e041787afcf523eee96ded8
  • SHA512 0758db5a55f5bfb3a54b70e491b40bc7f96d8fce39585e4d3d6c97041f00bcde330629cdc21f35c7aea5ef12590b460ba6d0ac0642a39c28901e5d3974bf35a3
  • SSDEEP 49152:vW9zybybybybybybybybybybybybybybybybybybybybybybybybybybybybyby2:+9a
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2