Extracted

• • Target
    0ca5ddf6a3f7930ce12092978043db995fb0ccae659a6a33818ce98b83ec428a.bin
  • Size 13.3MB
  • SHA256 0ca5ddf6a3f7930ce12092978043db995fb0ccae659a6a33818ce98b83ec428a
  • MD5 8216bd4e19049e202ff84fe3ed4c0f56
  • SHA1 da29cbc2c55a5f1deffa9bc770ff58b9c7bfae17
  • SHA512 75f6ff826b9ec04df17e82ef52334e92c10eaea7f8caf96ae39acebe438d8d8076d28f4e342cb6b0de4f73177c484422163ebd97c4cab1e2958b8a37af0a78f0
  • SSDEEP 49152:0eppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrf:0KA
  • TLSH
    T1D2E6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2