Extracted

• • Target

    f399ef025b4aad20f8d6bc1e3e23822d_JaffaCakes118

  • Size

    12.2MB

  • MD5

    f399ef025b4aad20f8d6bc1e3e23822d

  • SHA1

    225ca5bec26218e9b2ac60ff741c5aa8dabe243a

  • SHA256

    e72446ec15432b1960fa9fe6a6e468a6461433daf3e6cac79ad953ce0d10c686

  • SHA512

    d9b6fdc3207fccd6e55d037c2f0111ff07e4c03304e6b1095e2388a38c3c666e349c949d337d4bc222938cb87a0bbd69c1eac5bbb8509febc593d235cae38a33

  • SSDEEP

    24576:DRQITb1qsssssssssssssssssssssssssssssssssssssssssssssssssssssssr:n

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2