Extracted

• • Target
    df89477aeff4838a8c25fcbefcf869ce4567861fcce3b33faaa7818463dbb14a.bin
  • Size 14.9MB
  • SHA256 df89477aeff4838a8c25fcbefcf869ce4567861fcce3b33faaa7818463dbb14a
  • MD5 6da8f9c1abcac8d5d5133353016eee62
  • SHA1 2a39a6e71a9861ec062eab4c37f162dd78bffe7f
  • SHA512 ac684c4aa986fd3c7c29d20f7aa500b2bcd280701d0c90c00bcedde24fed77e14ad0df0cd20a2566f7fb9ec25140d6bc7aaeda1fffb31461bdd195527f62fedf
  • SSDEEP 6144:w1VCbRFuzFXpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzn:y87KFXp
  • TLSH
    T1F6F62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2