Extracted

• • Target
    54d93aca6578dc911dc6abcb167e0f93b263a158a87d9124d73106628c80ace7.bin
  • Size 12.6MB
  • SHA256 54d93aca6578dc911dc6abcb167e0f93b263a158a87d9124d73106628c80ace7
  • MD5 5be51bb6af6434fa164d3769c32e5209
  • SHA1 007af6d54cb16998e82633fe83bd7930b06f0c79
  • SHA512 5257e4b9c1171c75a3a03dd139a51e45434c47a6d926de67c1d06fc518495ce12b7b31c905081cc29ce9a736be79ef50afce93c9dd6d151426631993ff8782bd
  • SSDEEP 49152:RBp2Jrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrv3:RK
  • TLSH
    T15DD6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2