Extracted

• • Target

    JaffaCakes118_35aa868b9edc2ce3a80f966bf60815a4

  • Size

    12.1MB

  • MD5

    35aa868b9edc2ce3a80f966bf60815a4

  • SHA1

    f0d8809ec1d4fcb47277fefc601028b3aa22044e

  • SHA256

    f3563edb147f446d1ce0b58c6254619b17808ff2506c3f2ad32e11ed7910dacd

  • SHA512

    68ff649ff5c186e19e163a44b3f65e52d3e961b2d2a120103d37734355a03c5ab7c25f220dcb11e74d5ec2a6d6fb429ff273e46f3b441fc5ec3f62108165842d

  • SSDEEP

    49152:LN8888888888888888888888888888888888888888888888888888888888888f:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2