Extracted

• • Target
    8527cd434b299629fd7d5013a7f927dbdec48005369a7e6973ea79e659888572.bin
  • Size 12.6MB
  • SHA256 8527cd434b299629fd7d5013a7f927dbdec48005369a7e6973ea79e659888572
  • MD5 a4fb7ff59d248b88564bd7d65bf7ad7f
  • SHA1 25f97a644c060826697bff570d887f1d15f0fe2a
  • SHA512 92d3e4d4a7f47c501ec99c0a0557038dc1f70df1495e4c4885077ebb2642df1b3e35194211daf07b4059aad5cec179bcbea3952c970166cba1f3e52a3d8ded0e
  • SSDEEP 6144:XuCKPC8/pI+RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR/:X7B8/px
  • TLSH
    T123D63C2A803B24F5C6B0147CF78C7B7EA6FD05F4AEB4015B689C97C5E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2