Extracted

• • Target

    8b781b88987500ec50c623ccf8aa6a8a_JaffaCakes118

  • Size

    287KB

  • MD5

    8b781b88987500ec50c623ccf8aa6a8a

  • SHA1

    857882d0763580b23e64e1f3e4f7eb7bd9173b5b

  • SHA256

    c9ce74a6fde17c62cff139a74cb86d26c53196d0712a3ae677fa74910b34047b

  • SHA512

    d5f730c21bb733beb4230d006b2cb39a2a560598c08832ab6510a600eb80371cc72d05a3f45f5131a54faa8346916ac49c4f1963c17dc4eecf2de786308ac2cb

  • SSDEEP

    6144:8wkmQ1kUgOdYL9yOPoeA8rFXj77QWldyQG1/e:PrXyYL9yOPk8rFT70WY

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2