Extracted

• • Target

    JaffaCakes118_7b59084371e878c62a6b09ccf4bd82ff

  • Size

    14.1MB

  • MD5

    7b59084371e878c62a6b09ccf4bd82ff

  • SHA1

    57f2a5f62fde2b607d43de19d84958b6935a814a

  • SHA256

    12e184a9efc0897d7bec4c00b64355a5364faac11514f5fb6d2a8e3c2851c1b5

  • SHA512

    811b9ae6bea68ed73fd0251dcc756fffd95c0e891310978cd262f08667ae04ed811ee3b5f140a260b3b109770cea713b1d0907e43252c8af631dbc3033897309

  • SSDEEP

    98304:6wfDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDj:6w

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2