Extracted

• • Target

    7f0e78e68cad738676174e178952d043_JaffaCakes118

  • Size

    12.1MB

  • MD5

    7f0e78e68cad738676174e178952d043

  • SHA1

    f556a4c8ac98946b375f444f564f795474326632

  • SHA256

    2128c7ae82349263682d6a3206cc97b040c42e0e5d4424d2306ee30bb1b83de8

  • SHA512

    a2842f581e993dd6170a402ae6425ead4ad22eacecfec09fdae8575194b8f09fcc420970809dbf936945a0e13b3c935caab9867bc24d8ee5adc64680bf26c018

  • SSDEEP

    393216:9IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIv:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2