Extracted

• • Target
    74984b9f1b8f59f8dd21f265b150107e9de6d31b3c8827139af3f190c32a5646.bin
  • Size 11.0MB
  • SHA256 74984b9f1b8f59f8dd21f265b150107e9de6d31b3c8827139af3f190c32a5646
  • MD5 3fa5f52189ddf4ba636fa0bb7e968e39
  • SHA1 3e40560c80cfa66d1777252d0a0a4ed4fe08ee67
  • SHA512 397f3488b53efe8ba588bfd002531dd4264ad8b1abb73dbd6cb9fdd924da9dfc54c22ba62ea1f054fedbd3abeab6d9e3c4e05cbf3aa1a0e495b3d0eddb1d0837
  • SSDEEP 49152:wlpsCDrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrH:w/
  • TLSH
    T189C641AA76BA5ED6D08A0B3C0CB1D5174EACF634083A597251D140CF58EE2CAD73CBB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2