Extracted

• • Target
    3433fc98b62a41298f0f4e816b1875b164c66f4d86c3e8f3ddc40b2522ca25da.bin
  • Size 13.1MB
  • SHA256 3433fc98b62a41298f0f4e816b1875b164c66f4d86c3e8f3ddc40b2522ca25da
  • MD5 bb4da39a16a11d147b73b56980c7bbda
  • SHA1 885adb9b9f950700fcfd1b2313a1d3aa1ba41099
  • SHA512 413390e0f23622e5c990f73a0802f0fd2edb9d53eb31d358f5b9b865d90235fe5a60d11295bedca15d0f9e8261c6241a418be0517f4ad84e07a81f74fd7f9cc6
  • SSDEEP 6144:K5VCb4QuzF5pIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzb:k8NKF5p
  • TLSH
    T160D62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2