Extracted

• • Target
    ba5b80a71608428f352330b2335d8cf436b836d7545852cfc1b81460861ce3de.bin
  • Size 12.3MB
  • SHA256 ba5b80a71608428f352330b2335d8cf436b836d7545852cfc1b81460861ce3de
  • MD5 32636269eb76ee2457102852737e6f1c
  • SHA1 5ec91f14c5ce2759d696b701d62cb491134a5057
  • SHA512 fba8dd50a4b10bb57f8de192e6df45205664615b9d1af5fd8b0d64cc780c252ab33691bcf850cf80a4836105183b73e11ec98d08bec918becb940d5eb458d3c2
  • SSDEEP 49152:0Bp2Jrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvr:0K
  • TLSH
    T146D6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2