Extracted

• • Target

    fb3047f88312a2511364821ffbf29fe3_JaffaCakes118

  • Size

    12.3MB

  • MD5

    fb3047f88312a2511364821ffbf29fe3

  • SHA1

    d4032a89a9e3d06df1c1c50b02ea07f4a2d4ff2c

  • SHA256

    e28c9ae1fd731c719960f6c4246f8931963c18c04dbcfb967749c0e17c2a4584

  • SHA512

    2022d1547e3d3aba1ec8be145547c08ed1a9f7cc0f4c9176e335b3b0769da88f4e7379acd08ce90ac01eb840c85aca167f5c22f9f130e427b03b7f964cc844d3

  • SSDEEP

    49152:5HM3pipipipipipipipipipipipipipipipipipipipipipipipipipipipipipH:RM

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2