Extracted

• • Target
    5a66595586c04845091f1412c4bf71b0a1a4d90ce06503444c64c76f5c8596ca.bin
  • Size 12.9MB
  • SHA256 5a66595586c04845091f1412c4bf71b0a1a4d90ce06503444c64c76f5c8596ca
  • MD5 f97d64f5abb9dad930923a61ea5f6ca9
  • SHA1 4c089da593bf880ffc7a17300d687b07cb7297f9
  • SHA512 c633d1481b25c02e312a71df6d6f65e7a7898b70ee0b2ebc2d3e16eb03cd8adbab00ac568df50635bef3ca56056c35a45318f3881e8c19c580faf1876c7fc0f3
  • SSDEEP 49152:TeppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrX:TKA
  • TLSH
    T193D6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2