Extracted

• • Target

    b45db2c776b80d9917734597ec4aaec7_JaffaCakes118

  • Size

    11.2MB

  • MD5

    b45db2c776b80d9917734597ec4aaec7

  • SHA1

    9036a908ff16d45a0ce8a281e73665affd118091

  • SHA256

    c04a5f65f05b9b01b6b4c594a5e7a20c5d6a0cc78e92a782fba497dae49f60d9

  • SHA512

    47a66f3b5e22d1045a71216fca4afd843f264f5046f3f7a9483e14964a0d42293b9b06c7baee7e9b09adfa6a98a67ba6073b7b9366169ca4cca7e7d912629365

  • SSDEEP

    6144:CVLzTNrHtNo3azgzs1anrC+ekTXiRpYjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjD:CVL3NrTo3bjLTM

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2