Extracted

• • Target
    0d818a4ba657b7284e02ae5ff51ffe8e9bf69f788d34a41947d6582f3724f04f.bin
  • Size 10.2MB
  • SHA256 0d818a4ba657b7284e02ae5ff51ffe8e9bf69f788d34a41947d6582f3724f04f
  • MD5 46b1acf10b274ffe406f4b2e714d8a23
  • SHA1 66b754a6649be8aa4dab6c351ff0f5f9c0ff9d2e
  • SHA512 6f65190d03afffcf7bbe240c318caeed90d54c64812cb519aea1184228ec4e83d6224c4fc4f9287b9b1000eeb540634883504f7791c4de5cb4b2df6d7881a142
  • SSDEEP 49152:nKpbWrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:nO
  • TLSH
    T1EBB641AA76BA5ED6D08A0B3C0CB1D5174EACF634083A597251D140CF58EE2CAD73CBB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2