Extracted

• • Target
    7ff1d16cad1207a549152cedc5c1415f79073030f789860211aac886a4f0e1ff.bin
  • Size 13.7MB
  • SHA256 7ff1d16cad1207a549152cedc5c1415f79073030f789860211aac886a4f0e1ff
  • MD5 93c7a6aafdd0bae2beef3c431e13a9a6
  • SHA1 eedee6a971e7c140310d13d59d3ea09afef33769
  • SHA512 c3f1b324c7e5bb5075925cac9f88543569cf5ba2da50febb2720b8cc39f03577ed590ad30e0690157141cf2a99fbe177092859be34f6f04bb8b71502ce878503
  • SSDEEP 6144:2QCCYpnLs2DpIefffffffffffffffffffffffffffffffffffffffffffffffffr:2QPAo2DpF
  • TLSH
    T1DDE64B29807B28F5C670107CF78D7B7EAAFD06F49EB4016B689C97C1E4289D454EC6A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2