Extracted

• • Target

    JaffaCakes118_8fde8b0fd9fb569180caa7332394fec8

  • Size

    13.3MB

  • MD5

    8fde8b0fd9fb569180caa7332394fec8

  • SHA1

    0e0750c3ab52fc2b95727f92541848fe3e4e0e1a

  • SHA256

    fccafebc3676168caba30cd188d3ebb00b4fffe26ef2754468d4883cad7de571

  • SHA512

    ea91950a3af96c3bff8a26c724c7925b3f12ade6b69f931c80c589d4a522b7805fe95f5f47fb42272ff583ac0e0c666e0e469725e57b25a740644244cfb18df3

  • SSDEEP

    98304:jRoooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooX:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2