Extracted

• • Target
    82511e0d07082aab6e223e5e85e9ecfe6e0806d1ee623009495d631b34097fda.bin
  • Size 11.3MB
  • SHA256 82511e0d07082aab6e223e5e85e9ecfe6e0806d1ee623009495d631b34097fda
  • MD5 09c29e579a4750cb7706207ccf1b4688
  • SHA1 9d30b8152ef0eaa6fa80e6783ad7566b77335399
  • SHA512 564ecc4c51d9c11d6161a8faa442f891e5542f91e92172ca5109d130e707a50dd061660a2542713fe93cd4af78b661d6f90cec19aaff9043c0f8e5f5681bc600
  • SSDEEP 49152:0eppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrX:0KA
  • TLSH
    T13EC6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2