Extracted

• • Target

    JaffaCakes118_67f1dd72e4ab8cd18349384a17dc0d90

  • Size

    14.5MB

  • MD5

    67f1dd72e4ab8cd18349384a17dc0d90

  • SHA1

    d5e214f0fb5474a7dd085e6af38ae50f08bbd954

  • SHA256

    034c3cec7c957bc0389b3c8626da669cfa25635957f6acf9cb1c3eec2cfe8643

  • SHA512

    2c1066b4e29e49d1010c2e58750aca502926552d43ec32bb9b838af62f88b29205d16b8f4d3f9521c88f2c65c00afa512fab8f99a5206c042cdb8b2f87dc048c

  • SSDEEP

    196608:/tPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP3:/

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2