Extracted

• • Target

    JaffaCakes118_bcabc295b45c3d62fbc279122262e7e5

  • Size

    14.2MB

  • MD5

    bcabc295b45c3d62fbc279122262e7e5

  • SHA1

    b93934170d87fd73182a57d312e1363c35b7923c

  • SHA256

    cddfcbbe5656cb29b2976fb1267fecf1c605b9d6752f6449ce8c204c3b994169

  • SHA512

    ad55d782f55d87309219bfcd4a02bd9f44ad682c9f4bf4002c4011ba8aebd87a47df5b9b3664c783061304c3171b9a539bf6a4e45e724243290f05da105b0413

  • SSDEEP

    98304:6vCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC6:6

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2