Extracted

• • Target
    4196bd907e8b0673e0a37df064d0b4586e94e92880aede28c5d3a6163f1db7ca.bin
  • Size 12.6MB
  • SHA256 4196bd907e8b0673e0a37df064d0b4586e94e92880aede28c5d3a6163f1db7ca
  • MD5 ca0bc2837713d89a295117f579de8397
  • SHA1 878908a6113e084a74988927f68ea9d933b38fce
  • SHA512 09fe8e46baec213ad8a3abe6b23b2564265acb4278a2b2b88db2c4803263cf326c683b38b32b6a6d59e47c257a48dab12a93c95c5c365ed84a7c86730815f2fb
  • SSDEEP 49152:Rlp+5rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrv3:RW
  • TLSH
    T184D6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2