Extracted

• • Target
    5354899b7255cc88625bd5f738240ae03e322b0b8a6342c28bf108e9f9dd132b.bin
  • Size 12.8MB
  • SHA256 5354899b7255cc88625bd5f738240ae03e322b0b8a6342c28bf108e9f9dd132b
  • MD5 a4d5d0b3373a50c40f4ceabbf02f7440
  • SHA1 54c8f7916c025c01a3fa6f56e89b910c48807f81
  • SHA512 a5296fa52ab56beae71a8319de43d295de872534ec2128b1ac4bd01064aa70fdfbc5663a9142443c30e4ec1de027613e9101e93f783e309239fd84c1aaa3f89f
  • SSDEEP 49152:Mlp+5rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:MW
  • TLSH
    T11CD6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2