Extracted

• • Target

    c12142a8710fe99c29101f78dd31d5d7_JaffaCakes118

  • Size

    13.5MB

  • MD5

    c12142a8710fe99c29101f78dd31d5d7

  • SHA1

    4c638ca8cdb0c581ba1323101b485973d724b917

  • SHA256

    2dd88c2cf5f3ad49a46e6cfb88ec470423992ea5365fb55f7890af7e3d704662

  • SHA512

    0944f49c54d4f488d55a477ff3767c72a3807148718e63745cf0795b570be48a7baf6fb3d5f19747918897c5cce588d1fcc60bbd6b91bfdc85de0546d9b64100

  • SSDEEP

    49152:RT81MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMk:RT8

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2