Extracted

• • Target
    20cc06d671ab83cddc766d05e4395cfc0d198d78d259779ed8cab81d3cbe253c.bin
  • Size 11.0MB
  • SHA256 20cc06d671ab83cddc766d05e4395cfc0d198d78d259779ed8cab81d3cbe253c
  • MD5 5a7ed06a13222d572d9f9468ff95bafb
  • SHA1 17f147936b4af16b575c38adf18cb77ce9136c1d
  • SHA512 0cd4c4145865b42f0cbd8452005550ac1fb71834bee996145d12873162e77c2873b61fc03b5cc0dc158fd8186e38b7a4e9075832eba955df4e3df8ad7be464be
  • SSDEEP 49152:QlpGfrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:QO
  • TLSH
    T129C6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2