Extracted

• • Target
    e88e5681627f9aced1ac9cb9ee70c344276cbb770019678cc96966fbd7db44dd.bin
  • Size 13.6MB
  • SHA256 e88e5681627f9aced1ac9cb9ee70c344276cbb770019678cc96966fbd7db44dd
  • MD5 03272f226390eba2dd57ccd38f187d1a
  • SHA1 1039101daad230a1290f15243b71cf0e7fbb79f1
  • SHA512 c6e6d306d59090a2369b8e053f95df948d41210328281cab89f29eaea1ca7087a1ace040245fe0686120e09341e373dad236f4703bdbaa989a03fb489ba37ec2
  • SSDEEP 49152:WlpsCDrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrX:W/
  • TLSH
    T109E641AA76BA5ED6D08A0B3C0CB1D5174EACF634083A597251D140CF58EE2CAD73CBB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2