Extracted

• • Target

    f7ca2b5fa8a56cdbbaf4746b4ceb1ba7_JaffaCakes118

  • Size

    12.5MB

  • MD5

    f7ca2b5fa8a56cdbbaf4746b4ceb1ba7

  • SHA1

    03296181495dcfaf87ccd3688e5b459955767813

  • SHA256

    437ebedbd294676d87317e8c2f19eca989a12cfb7e2ea03824d2e01ab32512e8

  • SHA512

    c3a9bcfc5d0c85b65b96b6c1cc6f90ada63c00d37d2a11a5b14e9b7201df13f40d0997737722e6cff2462f624f810551da895005e6534b3f3961845ef0cb7925

  • SSDEEP

    49152:G2mNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNn:X

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2