Extracted

• • Target

    a1cdfab5a4af43636fe8141ba9bb2215_JaffaCakes118

  • Size

    14.8MB

  • MD5

    a1cdfab5a4af43636fe8141ba9bb2215

  • SHA1

    fe8e0d854dee3d741167f4c302b5f05c71e23189

  • SHA256

    a492284b3b05e75509bd1b8b6e7f73b5bf7f78263d5725082a8c76bb782b3c63

  • SHA512

    9dca7bbfbcc6178eecc0221afae418b5012d27b4023e754d0db54811d57074b21583f400408fe06790869585eee163ece122dfd064050287ce7d3561c151e37f

  • SSDEEP

    12288:F1vfanyphPu2xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFz:zvfEyph

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2