Extracted

• • Target

    b44f56e69a2fecb2aa2c087de04041a8_JaffaCakes118

  • Size

    11.8MB

  • MD5

    b44f56e69a2fecb2aa2c087de04041a8

  • SHA1

    c4277bc1cd4b2f6218659949a9749ffb3b8ac590

  • SHA256

    e95dc31697c70aeaa6ce846868058f3d47a94ed236b2ea45028f4c1e71ff9009

  • SHA512

    71d04ebaad7f507907fa5958c6bc369b4cf02bfc7ee892a6a2ad89e67eafe432bbf60c589dee657ed29b6fa4afdb72fc577f7ad11548647443c04a1ad5f0cd13

  • SSDEEP

    6144:IesoFeYHECHsLsx6mihb12P5qpWV0m68jM7LjmpeM:Inu/HECz6S5QWlnqOpe

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2