Extracted

• • Target

    JaffaCakes118_2f0b4b4819d48ff7ba4dbeb258a93189

  • Size

    10.9MB

  • MD5

    2f0b4b4819d48ff7ba4dbeb258a93189

  • SHA1

    98067909fa21b0bf107449206405ac8b13e5c776

  • SHA256

    3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4

  • SHA512

    090e957459548ed42424f07cb387664bff76d0efcc5b36943339b909290696496738c0b4586f446df4f6c0f1aa4faccb6ad66aab404a8775e7146491b4cd16e1

  • SSDEEP

    6144:HLmhaXrxJHCx7HdqAT7mvs/bNAk3B79NmVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV1:HLmhaXrxJHuHdPT1n9N

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2