Extracted

• • Target

    9b769cda1ae8ae818ab31597bb6b7bed_JaffaCakes118

  • Size

    13.1MB

  • MD5

    9b769cda1ae8ae818ab31597bb6b7bed

  • SHA1

    63e0402438e10592e7f110ded216cd00cd6f96fb

  • SHA256

    e696fdd3d19e5c9ebcd5f5435ef8819fb793d6a97d16108ca2e9f0fd5433ac8f

  • SHA512

    0c84f43118c8bb3c37bfa8b2f3c8c915bafa58f0c258dc7e12886a66f8ad125c839a98ead5d3eeee3520c61a88e24658efce0a8e0d9bee46ed95bbb5677fdf7f

  • SSDEEP

    196608:3RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRB:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2