Extracted

• • Target

    JaffaCakes118_1f81a2c3835fcdd7652325ea0eb70326

  • Size

    12.0MB

  • MD5

    1f81a2c3835fcdd7652325ea0eb70326

  • SHA1

    a0297513774b23399b9e1747b68db90bba1a097b

  • SHA256

    024b1ff3808f448395efcc16feb5905a841149f9765a3a247a8437949108fa51

  • SHA512

    ccc3b7dbd4a8cbf01c3a4c1ceee8ded3b6882ce8d98c0059b51fac3249ed860b7ea21d229fcb9f61dcc658322ef393f2ac6c7cc4554fb904da73f573d9db295b

  • SSDEEP

    49152:y/m3UeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeK:y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2