Extracted

• • Target

    ab87b84a0adc37db621ed3048349fe7c_JaffaCakes118

  • Size

    14.0MB

  • MD5

    ab87b84a0adc37db621ed3048349fe7c

  • SHA1

    cc8688b7eeeb7a0655a98fa152e94d35f452aa73

  • SHA256

    1fa257f7b2a9e043722395250eb0e81fe3d467da15c75d97042948c1fac5edec

  • SHA512

    9195b86abd69d327c51e5424f329d99b6cd2454606597d3e925f76ff2606fadfeb81cb94abaa443c18e1b45ae868710390b76299dbc35744f8058dc9725a4d15

  • SSDEEP

    24576:6htJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu3:DF

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2