Extracted

• • Target
    7bfa48ebaa48c2b7ae8c5e1dea8cd0f64953e1f95f60d4439d949ebb5c82673d.bin
  • Size 13.9MB
  • SHA256 7bfa48ebaa48c2b7ae8c5e1dea8cd0f64953e1f95f60d4439d949ebb5c82673d
  • MD5 9f3d95cb781c228672a4250769c42781
  • SHA1 8633aaacd6525015e7db289ccaf02e645d0d6f0f
  • SHA512 2fb5825721ead494742d0217b02e0fee4649dd0dd4957f6e107809e8bd895a7d6fed23177cf16164f4a540b3b67d531b04d057a0b252deb60aaa6e9f8ec84a94
  • SSDEEP 49152:DlpGfrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvP:DO
  • TLSH
    T1D1E6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2