Extracted

• • Target

    85c28ed504a9641d91449cc374bfdf3f_JaffaCakes118

  • Size

    12.7MB

  • MD5

    85c28ed504a9641d91449cc374bfdf3f

  • SHA1

    32bf88471d0c2f15bb525fd71eb75c9fc484a998

  • SHA256

    2f1e0eb9ed8589890be9756528e46acfc275a2bb5b797c370c6b95a9f6e8eb61

  • SHA512

    3c23870ce8685421a8f82a4eed8e9309aa649a364750ecdc0bb2607584b00de0e9cefff1db9f67a8d19f7e09c2e9d32b47d0d5c7cabe758a29c3f35d8dd968ec

  • SSDEEP

    6144:evk9RADRUv1CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCn:HRAD

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2