Extracted

• • Target
    284e66a7074c00905e2ac3a00026a8ee69b7ae22dbf55e4f898ffa89df5d551c.bin
  • Size 11.6MB
  • SHA256 284e66a7074c00905e2ac3a00026a8ee69b7ae22dbf55e4f898ffa89df5d551c
  • MD5 4295abc2e984b80469581336be8c8fee
  • SHA1 fc18e6a5c0bcb6fad6fa5b3361d5766d551210b9
  • SHA512 6957f1dd1dbf299981c464da787760d12fc4c8bff28bc3bea7a3ac6c18cedb60bf244bcef0b087bf23c76312f57193b7de282cec08741897c07ea06e50d7c1a6
  • SSDEEP 6144:lgCmcVBiLF1pImLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLB:lpjMLPpT
  • TLSH
    T1E5C62B69807B24F5C6B0107CF78C7B7EAAED45F4AEB4015B688CD7C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2