Extracted

• • Target

    JaffaCakes118_8f0c7ed7dee073b4d77ebc9ae3e91730

  • Size

    10.0MB

  • MD5

    8f0c7ed7dee073b4d77ebc9ae3e91730

  • SHA1

    9859b88ddf30f3ad0275f1af5595cc175aa72808

  • SHA256

    a766c56d729f2d60d7420c27cc346dd2b360e2b620061ceccd86c3efaafa3d21

  • SHA512

    d55db62d314bb0f1fbfba9e33345098877c4985a1a139159422fb2fdcf70b1cbef271748fd13a2f467b3c42423c90c386ccccc0ced0e1bf63044a04bf4397cfd

  • SSDEEP

    49152:cvqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqS:c

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2