Extracted

• • Target

    JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1

  • Size

    11.1MB

  • MD5

    eb79e351abac2662239b0b6c141d6ea1

  • SHA1

    cf3b72eea6b5b9478da32a5a3b4c9efb2b460b66

  • SHA256

    96946f52a7f820fe8904eb72f1e41b434e0139de8b2af99e51cb6b0b6dd89ac8

  • SHA512

    6a76d601c61f14f4afa8105b0c3ea064379584d2d9331a6c0863adc13641aeccd111af21881f8aff3b70d3566793df6121a44a90288b16a231c9fea9af83d27a

  • SSDEEP

    49152:89GbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGn:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2