Extracted

• • Target
    094c9750498582092992fe7bdb4011dfeef647a978f3c3f107a8cbbdfd30ed39.bin
  • Size 14.8MB
  • SHA256 094c9750498582092992fe7bdb4011dfeef647a978f3c3f107a8cbbdfd30ed39
  • MD5 fb70343cdeb0d154247510946c44e23a
  • SHA1 91686fbd26586ea87567a34366136264c2304eea
  • SHA512 58240e16f2a2180276f3cf41d411e0f64ad654dbce88baeb9c9d4f7ceef2923f9c790c218a8b6ff387a521e8059976f7d34548854cdab52e3347dd9490292515
  • SSDEEP 6144:LfVCnL+KFNppIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:j8KQNpp
  • TLSH
    T1E3F62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security bypass

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2