Extracted

• • Target

    JaffaCakes118_85fc255b144ad1bae941cb10f76c562d

  • Size

    14.7MB

  • MD5

    85fc255b144ad1bae941cb10f76c562d

  • SHA1

    6961b75a7e5e1720c6fd01b4979c77f3269e7aec

  • SHA256

    93c57d1b6044486f8962a08e6ce7c774d54c0dc8fad2da404eb99e451b75b2e9

  • SHA512

    e7e6ce112594f2d6a597ecd063e2797f1695be72dbd59316410d186be6e8876116662aa95d9ad25107a079b04eaffa7a7c039a99f2ef2fa15ae4681bace3f819

  • SSDEEP

    98304:/UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUc:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2