Extracted

• • Target

    JaffaCakes118_c2398c801dfe310d7ad448c4a0723027

  • Size

    10.6MB

  • MD5

    c2398c801dfe310d7ad448c4a0723027

  • SHA1

    5ccce6758b684103f7c64b638b7e40df83c80b82

  • SHA256

    67729ca5a906673b68e97c49031e4d3b7349f39e83e75d82f28f435eaee47636

  • SHA512

    e6fdd95a7362770e3ed2d48015f69141edf62fa1122881e019f20633f98b6dc3d8f7685c0d6a77f0b31d8ef6ec950def2aaf01901f76a674305b6da4c9f14437

  • SSDEEP

    3072:qMvoJ8oyOUQmaEa1otqKjHJSQEb/PUNnrU0vyHeN2hFRsGcPEH/UnpkWxeVxENO3:qMvw8F3QDEFgIpb8U92ebznbxe4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2