Extracted

• • Target

    9d352b6068831670fae5abf011f496ed_JaffaCakes118

  • Size

    11.2MB

  • MD5

    9d352b6068831670fae5abf011f496ed

  • SHA1

    e5c0461326655b1c828ce17d694dc21fc23fdc3c

  • SHA256

    63cdf16cd0b3d4c7b4b95be5afaa22532bc162806cc222f7e928d3a614d14c76

  • SHA512

    b886596e31eb5549658a239d3370caa8acacfbf1bf57815853c1fbab513f80de8dd75bcf2b1f189e5697ccbd36fa8d9f7d925c13c91af4c7f576edb930c0c2a4

  • SSDEEP

    98304:nn77777777777777777777777777777777777777777777777777777777777777:n

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2