Extracted

• • Target

    f3fbaee673990549c395e139685f204d_JaffaCakes118

  • Size

    301KB

  • MD5

    f3fbaee673990549c395e139685f204d

  • SHA1

    8f834c1c8c8576d2bfb68582f249f221e91344f5

  • SHA256

    8b1bbcd253430c07b2d9888582b495e829dab19646eb740aad3c72d17532a0c4

  • SHA512

    33fa4d05de64edb21b58b2bb2ff4f9e84f0878e5ab2fc080b210136ec38d64338ce087899ff6a51fa458ca34c5fca2df777f34bde2ad3a94074c4a5f55850d01

  • SSDEEP

    6144:3n78bLTMCrVUrxhkdceG8RjhqJL6ejOOhxxdeTr/ekI:XIb3jVUxU1foL6evzxd6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2