Extracted

• • Target

    JaffaCakes118_85c64a1eb4c5c0cd9a5d2a53bbec5616

  • Size

    12.2MB

  • MD5

    85c64a1eb4c5c0cd9a5d2a53bbec5616

  • SHA1

    fddc3bfdb09fa48de605b9607671c0ecc5ea6a3a

  • SHA256

    e8642c02dea577bb9c4db1d767f1028aa52e25b86c90369ada17a32c9b8c9974

  • SHA512

    16297cf27f2cfed4eb203ad12bb409a1a1c45e03d9bd6c539d7a15f102d3c1fd2cc5c8e263db97c6dbf5d2d240c81889cd8092d40495da6eb0822552f4e8b5fe

  • SSDEEP

    6144:8M0Em6Qk5N3ScccccccccccccccccccccccccccccccccccccccccccccccccccM:yEma

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2