Extracted

• • Target

    98b62dd2b4b9fca257de75573823e2f5_JaffaCakes118

  • Size

    238KB

  • MD5

    98b62dd2b4b9fca257de75573823e2f5

  • SHA1

    ad30ee3dae22e935f8654bf82a58e445e82e8181

  • SHA256

    cd39da40f58c16195e18922921d7eef5b3002b7e1598b55af5ac48663c433529

  • SHA512

    05399acfa54357ce2e5e805e06648a0ba3a810635606597d070e5f9056410d8569d492781fb6039366aa96b12b5b14a9025dafda2cdd0d094cebae5abbd378da

  • SSDEEP

    6144:NNytwy0vP4gE/r4JSzyEc9T3M+0snM6rSuB:NI+XvP4Z4JSzyEg7r0snNB

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2