Extracted

• • Target
    738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13.bin
  • Size 14.9MB
  • SHA256 738ce2cb6d6cf80b7b5861931c4ecf0fedf1d8cd4f8741b0c6e422a1efd8ed13
  • MD5 47ef08eccd4596c6659ef0f44c471c06
  • SHA1 9dd9a04554d294b12f2a68acad9ac4588d8e4062
  • SHA512 b9f9fb20da64383249e8cae5dffc268de6813aefa51fe5e4595c4741246a6671f3d125a7c523d094999e6af1eba0fc1f0b01ac9bffbfde333cf09dfa36f96e0b
  • SSDEEP 49152:azp2frvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:ak
  • TLSH
    T129F6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2