Extracted

• • Target
    e1bc59a6019b369832ae223654ddc176f43700da7cc16f38726b5686cabbbadb.bin
  • Size 12.2MB
  • SHA256 e1bc59a6019b369832ae223654ddc176f43700da7cc16f38726b5686cabbbadb
  • MD5 d504c78c043e4c50535c47d7caa3885a
  • SHA1 5eb1da648b213a9701de44c9903ed5474959b328
  • SHA512 f6b94e8dd901575e1eac247ff5f9d16c0c85d63eaedb434bd49d8e7823825e74494ee1122a4b295e8005fef92b33844148bd0fa218165cfdb46946e5e7014c6d
  • SSDEEP 49152:HeppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvr/:HKA
  • TLSH
    T129D6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2