Extracted

• • Target

    JaffaCakes118_c6cdc26d4da1406f0901958066c6a85f

  • Size

    12.5MB

  • MD5

    c6cdc26d4da1406f0901958066c6a85f

  • SHA1

    5bcf2516112953906f9312b2c3cfb34845c00049

  • SHA256

    e484c2397a151ed82e2874060f335ffc33c6d442d4358158cfe385f75abc378f

  • SHA512

    4e9a67c17d2ec2848be598ab0a3bbe65c8a6c40fd25af41fe1dd649612227e0cb05b2e839b5c1e4062b16f757a1bc95f800ee50b382aea4791efe3c855ff7ead

  • SSDEEP

    49152:ZvUWkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkE:Z

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2