Extracted

• • Target

    aaf40981d6a04afce2b036eb98670a9d_JaffaCakes118

  • Size

    11.1MB

  • MD5

    aaf40981d6a04afce2b036eb98670a9d

  • SHA1

    e202b436f978d78253f0287fc7d1597e4079d5b0

  • SHA256

    bbe7d154232e8e07dd0aeeaadca111e11bd6814ea2c3dc1d6926b7a6f2d58693

  • SHA512

    267c6496d78e0895a0afab297727b588a130493c92c9a578aedbda138562c2b009a56467fe06017f207396b9208c7c90cf6f3fe5d1f373b9e80cdf98bf39acc3

  • SSDEEP

    3072:trLSAaIXFM9X/WWIyOEfEDQMZWecFKmZ:9NWktyH9V

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2