Extracted

• • Target
    9fa69c7e4d124882d901cfa582f39bf36b5bddcf8d9016ea1be402bde3f57050.bin
  • Size 13.4MB
  • SHA256 9fa69c7e4d124882d901cfa582f39bf36b5bddcf8d9016ea1be402bde3f57050
  • MD5 0117a3cabcdb4de27cbf64cd5f79cfe4
  • SHA1 6797184d9165579ef4ba1b4196e9bac499264c40
  • SHA512 abbb7fe8d71f8d2c81c2aec06118416992249de92fe0dbea010c6357790881e1e5dde499f44c20fa1cab1d8e0dfd9fee052cda663af64b603743c793a078ffc9
  • SSDEEP 6144:t5VCb4QuzFJpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzb:z8NKFJp
  • TLSH
    T1AFE62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2