Extracted

• • Target

    JaffaCakes118_5af5f614cca9e39b1ca31bedd6bfd18d

  • Size

    10.4MB

  • MD5

    5af5f614cca9e39b1ca31bedd6bfd18d

  • SHA1

    45a425802fdcbf3d5bce39a73c972569af715958

  • SHA256

    9cfdc0c6aaa377d24461f118828636346eb37772b83c2501cd9529284ac29f62

  • SHA512

    43cc0ef6103967b2f70d414023ea1605fa02f2828bb10e9e0c53fc4ccc7dd71f71bf8589b67345876b9c1d2fa57e5782826170931d7d5414e274770197ce905d

  • SSDEEP

    196608:qwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwn:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2