Extracted

• • Target

    8bef47b423bc1318ad88f0d239717e26_JaffaCakes118

  • Size

    11.6MB

  • MD5

    8bef47b423bc1318ad88f0d239717e26

  • SHA1

    f6015b826634751b01f561540a034b7e8bccc46d

  • SHA256

    93f3712dbebaafe28d0c52837e64ebdff4faf292f1a6b75abb885cb6e719753f

  • SHA512

    5c885dd3f1228ec73330d516f35dbb352caddf0c0ebe57fc9d21324293f1fc933358940fe38e83fab480a62713c6d11d98f3bb92a82ceb65599e6260b8e919f6

  • SSDEEP

    49152:ipWkhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhN:ipW

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2