Extracted

• • Target
    8b781b88987500ec50c623ccf8aa6a8a_JaffaCakes118
  • Size 287KB
  • SHA256 c9ce74a6fde17c62cff139a74cb86d26c53196d0712a3ae677fa74910b34047b
  • MD5 8b781b88987500ec50c623ccf8aa6a8a
  • SHA1 857882d0763580b23e64e1f3e4f7eb7bd9173b5b
  • SHA512 d5f730c21bb733beb4230d006b2cb39a2a560598c08832ab6510a600eb80371cc72d05a3f45f5131a54faa8346916ac49c4f1963c17dc4eecf2de786308ac2cb
  • SSDEEP 6144:8wkmQ1kUgOdYL9yOPoeA8rFXj77QWldyQG1/e:PrXyYL9yOPk8rFT70WY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2