Extracted

• • Target

    JaffaCakes118_aee483bf0ab0bbba03e7add1c7b24d70

  • Size

    12.5MB

  • MD5

    aee483bf0ab0bbba03e7add1c7b24d70

  • SHA1

    15ef01d3f681c7ec8cfb1e55a318723f4f4406f7

  • SHA256

    79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f

  • SHA512

    4dfe9bb49aec68b29055ab74aaac4efd83e96051072aa9f15bd2a8530376ba58f1b3d7741229a5fd96f81cd92ead9481918b4fe580bcc4baae158269d985d80e

  • SSDEEP

    6144:0ngjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV7:fiOE+Nj4Q50k0UGIh+dJ

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2