Extracted

• • Target

    fc832fcf8a81a723b469f0c61ec13921_JaffaCakes118

  • Size

    11.0MB

  • MD5

    fc832fcf8a81a723b469f0c61ec13921

  • SHA1

    8c41e497db55c105b538355863f9b137fd751fd2

  • SHA256

    aff73b798d917f95cf4c0e08ec0b0ec7af5eccf2669883fff2ea9d8804a1561a

  • SHA512

    cb408d24cb73eea90a94bf95faea321bdcde24bfef226253fa69482bdb1584e2abe58069d727d987adc841066c248b0a60d9b08e7a34059eb421268445e9e529

  • SSDEEP

    12288:Nb22XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXn:l2

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2