Extracted

• • Target
    e76e4b31e9473c72e416c368970486f3bbfbdfcfe7c1bd6d415a405b8c634c2e.bin
  • Size 11.2MB
  • SHA256 e76e4b31e9473c72e416c368970486f3bbfbdfcfe7c1bd6d415a405b8c634c2e
  • MD5 95b3f198ed94671dedd33cf2a499acb0
  • SHA1 046ab284fff6440c268bf43192de143109c8ada0
  • SHA512 8493479f68135cdd3a021e03e5ba811a3f9477a67f55a23299e9bfd93b69cf07a5ec4c304ba96e5cc12e5745f6ef9b92152cbe32a3e22d51b66f6747d3202b73
  • SSDEEP 6144:oAACGHIqhC3M5pICfffffffffffffffffffffffffffffffffffffffffffffffr:oAJXqM3M5pZ
  • TLSH
    T175C63A29807B28F5C670507CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2