Extracted

• • Target

    7a024b0d37c1167f69a9c9766c9af3a9_JaffaCakes118

  • Size

    10.9MB

  • MD5

    7a024b0d37c1167f69a9c9766c9af3a9

  • SHA1

    7ddcff26d726b0cf3151704cf0f9e51158b93279

  • SHA256

    952e4b5bba456e1bb30334d28d421a937a18a5ae6926ee914172f89c65e24acb

  • SHA512

    236063040255aa606c77ae22a5a8b1a75b0953a09ade29096c76bb77cbe5b4fbee36e39fdd7ee9fca9bc71d965bbc2f6bff705aa4e3879c24bf04f7df0b6bfc8

  • SSDEEP

    98304:rYTPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPv:r

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2