Extracted

• • Target
    ed247101c7f12d4ee13007314837de2d70042f7318f94adef43e1d0408454309.bin
  • Size 12.4MB
  • SHA256 ed247101c7f12d4ee13007314837de2d70042f7318f94adef43e1d0408454309
  • MD5 d08ead51c3ac603350cb108c2459d94c
  • SHA1 e001dedf518e61ba829f4e3a9df5e2cb28e00841
  • SHA512 9f3a09e293edef90add82bb52021f7a7887c07239c37e666298d47b94accfafd81c72b6958ea26e8ee6ba425f3163b7d8fa1f31d75b618f3a4831a0fea7a3b55
  • SSDEEP 49152:rlp+5rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:rW
  • TLSH
    T178D6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2