Extracted

• • Target
    3b40237ab21ab21b7e78bd7fbe873a3fa84b71bf409181e710051e88e03e96ae.bin
  • Size 13.7MB
  • SHA256 3b40237ab21ab21b7e78bd7fbe873a3fa84b71bf409181e710051e88e03e96ae
  • MD5 3c10ab7e5987f040e0a170911eff5e0f
  • SHA1 6d72401e7f42b1195b80e624d7852c6dc46e9f70
  • SHA512 5399d2671f467fa1aa88bcc069927292dac6135a37a6e553e838bedd2776861feeb7ae149522d59c4b7d327a50113664dea68f00cf5b7dfaef6866ec27ee8aa3
  • SSDEEP 6144:x5VCb4QuzFopIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz/:n8NKFop
  • TLSH
    T162E62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2