Extracted

• • Target

    a2f26ac6d777b4fe2c91e979c4fa9aa8_JaffaCakes118

  • Size

    10.0MB

  • MD5

    a2f26ac6d777b4fe2c91e979c4fa9aa8

  • SHA1

    7563de6150b7c7743757bb0a90afb9f2c7627d8b

  • SHA256

    d603d68330bbeafc83eee0776c42cd3060edd9431b98b504c889ef70535e8854

  • SHA512

    d66f5dc3ba39303ca7ad4694c25b81e5e282bca18ae0e5e4f09a37a481b0e38d130626ca59041b2fe4660d28b4cd10959cfc0a0ec1eb85688d0d91c581846395

  • SSDEEP

    49152:Muuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu3:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2