Extracted

• • Target

    b253f5b8d1f9aad76587136d065831e2_JaffaCakes118

  • Size

    13.6MB

  • MD5

    b253f5b8d1f9aad76587136d065831e2

  • SHA1

    1b52e954d04c96a82e24f74ed38ab1136cdec4f6

  • SHA256

    789e9198d141f39bf030563420328dab4477ac3d60cc87244c6aac684f0aac5e

  • SHA512

    1ab9b1c968ab3ff32b9e8e19d1bd7d6cd1d19ae601ea86cf20eab684036c0b7a0464f45e36a46468c4684f84eb61217520ee14be862a72e5c075e4751c12a4c3

  • SSDEEP

    98304:cvjOF//////////////////////////////////////////////////////////H:m

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2