Extracted

• • Target

    JaffaCakes118_485037fcdfbbc9e974b35af5afaa2e35

  • Size

    12.9MB

  • MD5

    485037fcdfbbc9e974b35af5afaa2e35

  • SHA1

    533313aa52b4c2c91e1120bb3bf141a15a439717

  • SHA256

    8de7a9b847f9881f6c472acb4d995ec487c7bd2099d50338f474468f6c02599b

  • SHA512

    b3b3a790b4d635f8c37eecb5431587521fefc83172ad65fd065e5752bb2ae7f2e53f46f039d2626185c05926e9155c5deb6bcaf685dd49f7c8656fc72305e071

  • SSDEEP

    49152:cxYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY0:c

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2