Extracted

• • Target
    8c1e0f90366478c83bdd333ca6f796c5533a31c5d43e9a56e0a504c1646e1975.bin
  • Size 10.9MB
  • SHA256 8c1e0f90366478c83bdd333ca6f796c5533a31c5d43e9a56e0a504c1646e1975
  • MD5 70cbf108f9618801d9b3f4283843649c
  • SHA1 41f2e50e5b68865265ea369f95bc43b083d49b08
  • SHA512 e9d36780c9271d9a7831e72a57e622acb54d9cfa4a26ad37a9630a3fdf6b9b05bf9ab18d2dbd2644210974a09b09f5439516aff99b75b0fa8f845e9f84d2f350
  • SSDEEP 49152:KEp0Jrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvz:Kl
  • TLSH
    T130B6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2