Extracted

• • Target

    a29fc6aeae4e6f1b7adaea5606e9b839_JaffaCakes118

  • Size

    11.0MB

  • MD5

    a29fc6aeae4e6f1b7adaea5606e9b839

  • SHA1

    14ff72f09589a7319189e0d6aac5f8338cf2f382

  • SHA256

    b8c7e8989b4fb3b7624a69e30f9c629e5bc4f09687f1a254d157684ce2d7c501

  • SHA512

    93cb8fe859e86de40681cc6205a05b6569e131fe21e2798a9aab29103c1450115a1c7323675f76ee2c18c5418e3fa9b6ea46b4a36fd24a6fc2e6c361baaa2819

  • SSDEEP

    12288:+6oEnffffffffffffffffffffffffffffffffffffffffffffffffffffffffff/:+6

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2