Extracted

• • Target

    JaffaCakes118_4ed52beb87115613314a21d52638e6fb

  • Size

    13.2MB

  • MD5

    4ed52beb87115613314a21d52638e6fb

  • SHA1

    f85427d24582cf1a66606d171f6718d93b141546

  • SHA256

    60e01eabbc05e7a80be2f23ad0902b0598f433ac3bfd06e0371429893ceb57ea

  • SHA512

    fcd09c63032cba0d290ebef76830f095e84ccb4671dd53e4423cfcbba1fe0945e00f91b00c68b135591768937c520e71acad14dc3a06492de0208c17dd9b0db9

  • SSDEEP

    49152:MIc6CLNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN3:1c6C

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2