Extracted

• • Target

    7a5c5be60e0b6cf8fdc5d487a56cc60b_JaffaCakes118

  • Size

    239KB

  • MD5

    7a5c5be60e0b6cf8fdc5d487a56cc60b

  • SHA1

    bbc32678132d14ae7453c2617f399136123f3dcb

  • SHA256

    77cc13b69823c588274c5c567081f0d0cc02aca078dc0ad0040eee5ec9385395

  • SHA512

    e72d45cc7660f44e3ca931edb475a60700d653f87b3a33f81f12d16a14c6697b5cf1b1b3462471197c91927bdd8e28649d7eaaeffb3957b4fb76f705710cd559

  • SSDEEP

    3072:1NoWIXVg044YmyJc/rY/2Woct6Mz+7L00vyLf9nQLWLIMcesvKeHTQzIaH/q99Q4:1NoWwy0jYBkE/vocLz+2QSLIBee8q9N

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2