Extracted

• • Target
    ddd2d89dfa3fa434ac9fd608437b5d59c9aeb8353fe2a9eb41836a60d8761631.bin
  • Size 13.8MB
  • SHA256 ddd2d89dfa3fa434ac9fd608437b5d59c9aeb8353fe2a9eb41836a60d8761631
  • MD5 9d57a265ffe05c68b4fc4a9ba584bebb
  • SHA1 308f172748feb3c06c8d494d30e298c86c3728a2
  • SHA512 2c34942d615ce5df9c860af34228ff4d981a9f3d5bc61629dc1e481e1c86551bc729446ce58ba0127cbd86df61a6a5b960906228f30df7c12a58f5350d3a653b
  • SSDEEP 6144:y5VCb4QuzFopIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz7:88NKFop
  • TLSH
    T164E62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2