Extracted

• • Target

    JaffaCakes118_955cae2b97e363277394e684c1b3ff10

  • Size

    11.0MB

  • MD5

    955cae2b97e363277394e684c1b3ff10

  • SHA1

    62122067a9c6d464e5bec9012ff77fdf6ffc1dba

  • SHA256

    fc21c2099b131258186e137fc0b755cbe33b1c3f5fc96f3e1345bf9db4a5535e

  • SHA512

    011a62a7ceb84abbdaf1a917bb8b1f3f9fabac6941b8331f54c0b8a670740eaad0adb9f1af90c102787ae0a7248795d9953185102242525483f8c5e44be949fb

  • SSDEEP

    6144:WnYxnXboLAkQbueUH2KrDzFmN+xgGpXAB0ZO:zXMLLhH2AzHgGpXAB0

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2