Extracted

• • Target

    aa190a9ae1d43ce177ffe782289c18a2_JaffaCakes118

  • Size

    10.5MB

  • MD5

    aa190a9ae1d43ce177ffe782289c18a2

  • SHA1

    96a2d547b179174dbca7db8e8fef8a4fa7656523

  • SHA256

    e63b1e858d946a62434ca19dee046efa0919af7b131dff8b829a59a074542e03

  • SHA512

    d3a8e9bb7d4d6b17cad394699e4b82b159fa724ee2d45f820bf616c61f1d80568bacc71e7c4c26f417ba88492f612d2612f810ca62d3bb2e9d00a12f2a622d3f

  • SSDEEP

    3072:6MlpcoyOUQmjfWVKt+KjLJK5EbaPlWrU0vyUHlJTt/NKCQlpa+1082+ECOhOhOhV:6MncF3QyfvkIVifUJ/Qf3BV

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2