Extracted

• • Target

    87f88fbd6fc1edef8d83bfaaee8f53fe_JaffaCakes118

  • Size

    14.6MB

  • MD5

    87f88fbd6fc1edef8d83bfaaee8f53fe

  • SHA1

    27509f29c2b3b490cf2a7322f7f2cd828806c88f

  • SHA256

    d1b6ff4842c5e9ed4c82f2cc8abb8c449896dd3316be09c2ad8a8e64418480d0

  • SHA512

    08edb0c2a5be848dcca234d3f5f2df9c7ff85b54e2ec7a2ba9ed43dd0b7e7e00ad7b06eaba3b34253ef6c852596f1dbca9aaca3d5a5029585748a094a6bc9c72

  • SSDEEP

    12288:eZlC6v/5oQU6buXH53333333333333333333333333333333333333333333333H:ebjvluXH

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2