Extracted

• • Target

    JaffaCakes118_378a35c7ac31c7acf84ea568f6ef9318

  • Size

    11.1MB

  • MD5

    378a35c7ac31c7acf84ea568f6ef9318

  • SHA1

    8fe14325285e8cc111ad947efe3d1fb4df17d575

  • SHA256

    6be3100cc2f64e20f89e96bd1b0a487c1fca8afb8c3b92e51d3799517b7684bc

  • SHA512

    e6f0671c60d9426140b383a5a7eb3b288b51458697139d169b0b590409b6537417fb99895ca8113eec6731e02d8404a212735619b780e9c518fa65ae49fd252f

  • SSDEEP

    6144:HMdOABJjP3ty21A5M9FW8c3np3XTm9ntiAA:HMEEJD3t3A5M9FfgZXTm9nE/

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2