Extracted

• • Target

    JaffaCakes118_b8332866db45bf85ed517c599eaafe54

  • Size

    11.7MB

  • MD5

    b8332866db45bf85ed517c599eaafe54

  • SHA1

    f86726a6a85f613e15066a7ad77cef942e3c9d28

  • SHA256

    f365d1d600ccc20bde31b7db1fd7a815b73087c9e46676e0d398289af7b7bb71

  • SHA512

    b95ac93c7487fada804562e98f8e5db4902ab3195236c71cfa171732071d4601ce479b6eed519f61a0724a47d6cda7f9d397285c265b2c9bfb7d143ba8ef1425

  • SSDEEP

    3072:qoiqjV0QCeV75zMwb2EfDXTBrt0c5f+Z7ApWt+0krytpObPUfAGM4H1M4CjiJNx4:qoiqjWHeV9zthDjBrmA+VkDbSAgQiTx

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2