Extracted

• • Target
    c4b05937e0c46b3514fa25fa39f645e15a5122b1073b31071c4887fad1e78fbb.bin
  • Size 14.9MB
  • SHA256 c4b05937e0c46b3514fa25fa39f645e15a5122b1073b31071c4887fad1e78fbb
  • MD5 c84b469820bc47bd6ec1ec9e0b630ff6
  • SHA1 344ea7cb2f2b7526e62694d2068a3bbd253ecb98
  • SHA512 e4611986dde62be10de72e6292a563c4d514bfc8e95786e7ca81c0c0504f7a0b3bba2a0e5bd43177f44d64f9d38747b6ef0fd3019e998f633298f5fd74cb38af
  • SSDEEP 49152:6Ep0Jrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrv/:6l
  • TLSH
    T17AF6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2