Extracted

• • Target

    JaffaCakes118_31ce7ecd22ebd1a1df270380c9405da4

  • Size

    14.7MB

  • MD5

    31ce7ecd22ebd1a1df270380c9405da4

  • SHA1

    3b00762970c7d824bc8c1654554e3c8e8511153b

  • SHA256

    bb6c607816040da1719c56e42077b18439e7644d852e8a4a35ea396d8d488cfe

  • SHA512

    70d782175e5d115f41249285aeb17c74e3b0b7ec18ab61eae971bde498ebd1cc2f95759d3a51791301444941d51030601fa2405b9bb84915b088461c5ed32cb9

  • SSDEEP

    49152:DkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2