Extracted

• • Target
    adf6006c7fccdb1020caeda769aa515ef089575d788fd6a5417cf7e3a4d41cb6.bin
  • Size 12.5MB
  • SHA256 adf6006c7fccdb1020caeda769aa515ef089575d788fd6a5417cf7e3a4d41cb6
  • MD5 34f522acfe31be665afa9234d893c90b
  • SHA1 076b6b16c63d47b3ec55a797ecb5b48d9141b7bd
  • SHA512 46f9e88b50185f150e5d765e60bb771f352447c9fdd9dee37c6185878860b7471731bce56ecaec422775e663137e87d1fec6b83fe9c0c79391d1878db1e9905e
  • SSDEEP 49152:oEp0Jrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:ol
  • TLSH
    T1B2D6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2