Extracted

• • Target

    cd5c610b70c17b78c91f0cc625b09f31_JaffaCakes118

  • Size

    12.7MB

  • MD5

    cd5c610b70c17b78c91f0cc625b09f31

  • SHA1

    681324c2ab69d935cf2e6daca83811a4fbc92793

  • SHA256

    0f5925ce372f42751218138d657177d1af0c08547b62a361a235ca16b82ba586

  • SHA512

    dd29fc33436150c30d5c9b1467e300ac3fec1cfcf19874d38b2c873704646232a6b3a354f8eb3c9276930bcca34da385d67b545bf852c65825548b5c770bc18d

  • SSDEEP

    98304:999999999999999999999999999999999999999999999999999999999999999d:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2