Extracted

• • Target
    99df1de0b5a43f47a69327f884799ae4b652deb1a985eccc62fe8741b090d44a.bin
  • Size 292KB
  • SHA256 99df1de0b5a43f47a69327f884799ae4b652deb1a985eccc62fe8741b090d44a
  • MD5 6744d7804bf17ba4da6017ce97d48074
  • SHA1 00900bca7e576d61578164ee7cf6903b6a00744d
  • SHA512 a2a487566ed0dc431831b905fecb805ef833c89a8194c6b71b7ba32600feecd0f2791cbb185be6d244d20ad3078643a2bde927c07723c0135866a3fa0c5e98f8
  • SSDEEP 6144:V1VCypWCbFlpI1DKk/6oVx98aCI24sEX9r:X8LaFlpVUvH84Lr
  • TLSH
    T1E754B092F6E1D073D493827169944FA29BBFFC306939E1D7B7843ACE1DA45C09A29343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2