Extracted

• • Target
    7a276cd58e742cb72869e46cbdfd60d28006787a61a02667298665e774e48c6d.bin
  • Size 10.3MB
  • SHA256 7a276cd58e742cb72869e46cbdfd60d28006787a61a02667298665e774e48c6d
  • MD5 114c748dc4c7129f6621e57ecc69eda9
  • SHA1 9a878c737c8f0c86fb38437ced3051afa2406ede
  • SHA512 b23389c5485272f0689f02d561263c7685c68c5b4c744a648938b0e18a0c28150a7486bf19a31666a2bd6bfb8f98fa09b94633c0f1c734f80663caf57037e9c8
  • SSDEEP 49152:teppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvr3:tKA
  • TLSH
    T1A7B6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2