Extracted

• • Target

    JaffaCakes118_1fe610316eb9a8d8526f9942a34cef4f

  • Size

    13.0MB

  • MD5

    1fe610316eb9a8d8526f9942a34cef4f

  • SHA1

    0c8fc94e795a25cfe499447432ac55b13618ca2b

  • SHA256

    c655e59546447547e0b3a212f95ec11f56a2180b9fcbe07d13b32e1ca824d07d

  • SHA512

    b91713bd86f0bdfde263588f517b4ddf8aafc370efa04a836235307e31489a4bb862992de0486839bfdc84e8c17d004c6d81d4d77bde867fc59d2711acb57e0f

  • SSDEEP

    196608:lYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYv:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2