Extracted

• • Target

    JaffaCakes118_80886a1c834f57b2fb57d166d1b31430

  • Size

    14.2MB

  • MD5

    80886a1c834f57b2fb57d166d1b31430

  • SHA1

    fe991ee5b5ee0678b4be9bfbbe6bded33041dd2b

  • SHA256

    9a6b44b5b8536a0cc1a4f7f996ca0ccf0524c591b382a0c1e6be630d172ad009

  • SHA512

    4e74a405389201795953be1a2dd8ce399891060da079bd52d23eb7c1340b12b9c49385c4ee0866090558a41548f9383060d4891ef1b8a9b90a98e9e0e8b783dc

  • SSDEEP

    6144:OM0Em6Qk5N3Sccccccccccccccccccccccccccccccccccccccccccccccccccc3:IEma

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2