Extracted

• • Target
    c8affd79a1f1cb11c7548ed4e23238f802ebef88d1bc0d42ffb8186e4c013a07.bin
  • Size 13.6MB
  • SHA256 c8affd79a1f1cb11c7548ed4e23238f802ebef88d1bc0d42ffb8186e4c013a07
  • MD5 6452ee8ddaae3904b03a6d6ff689b671
  • SHA1 fa836caa056aebb7a6569b9d6b4f6dd5177a2404
  • SHA512 a2761e718ec54a53ec84f084005e20d1063f3d99bf184828a43a034e2f3b06b1e2dd835f9593cf42ca077d71a38d4c439adc9adb992dea4c77bcc938d296290f
  • SSDEEP 49152:meppA1rvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrj:mKA
  • TLSH
    T1B9E6436676D86ED9D0CA0FBC09A1C42B5DECF734043A953096D1504F98AE78A973CBB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2