Extracted

• • Target
    e1a4b455e4491600fbe2f061b3cea6fbaf10cf16f4b1a898a12478a255fff776.bin
  • Size 13.5MB
  • SHA256 e1a4b455e4491600fbe2f061b3cea6fbaf10cf16f4b1a898a12478a255fff776
  • MD5 875e1bf3d06750b1d38f1e3414f1a194
  • SHA1 bc1cc16dccb364dd1e4931f897ce26894cd7dade
  • SHA512 617f370877ffb2e25c70c62e511994983b49d362024642cc11b3c8681899f6b91c5359eeb94e0b0dbf7d2b3fe0483181a036d6963102ed59502498463ed6ce47
  • SSDEEP 49152:4Ep0JrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvP:4l
  • TLSH
    T1C5E6436676D86ED9D0CA0FBC09A1C42B5DECFB34043A553096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2