Extracted

• • Target
    5f7c1ec8dbda6c613688d7f81926b7f8eebf2367979b35cf5d2756698262a9a9.bin
  • Size 13.5MB
  • SHA256 5f7c1ec8dbda6c613688d7f81926b7f8eebf2367979b35cf5d2756698262a9a9
  • MD5 920e5784c6601e2b24a160e098fc00dc
  • SHA1 5706a559347a8da6538bcb18b6c8d76940e1fb5a
  • SHA512 42f44a7fcadb0f5fda378b5b8077024b6cd56f656018bf4046b362e439aa9d67ed5a02fe420d7f0736c856d778e4749434299ab9ccf53485418e1d5cbf461f97
  • SSDEEP 6144:dPVCneO+XFvpIHzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzb:18p6Fvp
  • TLSH
    T19AE62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2