Extracted

• • Target

    9119f2bf0f3d575dce916735bfee6d40_JaffaCakes118

  • Size

    10.9MB

  • MD5

    9119f2bf0f3d575dce916735bfee6d40

  • SHA1

    3df2a3dbea0fac124dcc12c51adab22e90587717

  • SHA256

    07806de6097678888d093bb67843be36c53f8c88af87e78ba3b936aca6b79e74

  • SHA512

    b7030e213cdeac5945da8f2bc5cd3ddb6b4b6bd244b07540cbe78ce7545e5630e1e554cabdad5f63ff752e8e6994367c35de1411fcdc2b8a40b789fa9122f1d0

  • SSDEEP

    49152:XwAKFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFV:Xw

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2