Extracted

• • Target

    99bd790593bc23873774f48cb8b6f631_JaffaCakes118

  • Size

    12.4MB

  • MD5

    99bd790593bc23873774f48cb8b6f631

  • SHA1

    c50de27c7e448042bfdf7b127799bc7e2938ad63

  • SHA256

    a86bd033111762b870d19d8093efe3e70a4383b2167b5943c90a85a350d264b4

  • SHA512

    c70e97c269ee79d43a83bde7578cfa0904812f42f61e166f99ff98ff2f641dffda01cfb7acc6be44fb2dfbfb04cc217bae749f083906030285550c5e2a44c4f7

  • SSDEEP

    3072:iQA1TtRdQBPuEcbBNu28bMEqfCxn2kuIPe7epgDnESZ25jnE26nnipm0ul4p7fLO:iQA1BRCu93f8bMEoFkYUlUUsap8foX

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2