Extracted

• • Target
    7f1c5f0b80a77bd27bcd5461b0634156017305a85eb56fb09ea8404e67beb449.bin
  • Size 12.8MB
  • SHA256 7f1c5f0b80a77bd27bcd5461b0634156017305a85eb56fb09ea8404e67beb449
  • MD5 28ec4053a9a572b87a09abe6f6d967ac
  • SHA1 260d018c8f3dd82fce6f59b809e370fa4c6ca182
  • SHA512 83bac42bb0fc436e07fc0adf13d3902c5d1f87a5cd4b7a0b7be5f8b664188a9fa0949a009dc464f995f8b05cd7c32f51f37ac282f85fe4a2e08d8911947eed08
  • SSDEEP 49152:VlpsCDrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrn:V/
  • TLSH
    T17BD641AA76BA5ED6D08A0B3C0CB1D5174EACF634083A597251D140CF58EE2CAD73CBB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2