Extracted

• • Target

    JaffaCakes118_b980be7b566a6bbe882ad701ce74d0e5

  • Size

    11.9MB

  • MD5

    b980be7b566a6bbe882ad701ce74d0e5

  • SHA1

    4aada7c030925645611258643db8d8b91036cb78

  • SHA256

    743a19ceca5abb68c3e29578e5a7205b3a60199be70ac392b16bd1e2421278af

  • SHA512

    ffa38d7b12cbb0d1c191d7907e7d33c002ea074cf33d736f4ad4e520486338fe39ba7989f38e63d797e9d540a6be09ffcd5c27e27f6fefec574f0d62b35ad137

  • SSDEEP

    3072:6u034LyTdUfJjzBqFmdza1eE2xuBl7AoB9IP6YDU2EGFvOzp8VS9M65vKxlKZ99b:4GzoFmfE221B9IP6SjEGQ6VKNwl

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2