Extracted

• • Target
    b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b.bin
  • Size 13.5MB
  • SHA256 b9088751630d49d7b5dee27ac9a67abc1b292f84c1e9f5423d88595e88514c6b
  • MD5 c208ac6378b9142f7f1d04c23a693abc
  • SHA1 9c2c8707429fef79761f8032e41ff460ddb76985
  • SHA512 ae9d3696539b19c40414f04cf64891f7e5b482e451539b244e25f687023d6553e4a2b48bf46d2bbca7c06dd983625615cab6823729b8be52524f4cdd761b2dc7
  • SSDEEP 49152:LeppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrT:LKA
  • TLSH
    T104E6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2