Extracted

• • Target

    JaffaCakes118_6347b209373638144cf0ad83f9f6d2e3

  • Size

    11.7MB

  • MD5

    6347b209373638144cf0ad83f9f6d2e3

  • SHA1

    93ec12b673de5d7a7245d226750c105aae3cac6e

  • SHA256

    c56c665284628c1928a4951dd94214549570d48f5ae553fb90a67d2a132ac643

  • SHA512

    16cf949c45ad07c94b66e22e7bcb9e3c3c947fb150fd411bdf6c98d034145c47910c36be52aa895f012c378a33bc134ac50c766adfadd284333d52d37c7951f4

  • SSDEEP

    6144:I72USLqCfuAKEfkqsGUemWik5nkFp7xkvCd6skSwG8QUsc:kMqCfFfbsGZhikA7xkaYSwG81

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2