Extracted

• • Target

    JaffaCakes118_eb8a26f7dd1a2aa9cd9d0936ea552c1d

  • Size

    10.1MB

  • MD5

    eb8a26f7dd1a2aa9cd9d0936ea552c1d

  • SHA1

    919ab5a6753f6ef5610cb84d4aa123874183b0d0

  • SHA256

    015f6f0f6fdf5021bea0fff32edb4a157a6fdbc247defea1014db3dba9ac1803

  • SHA512

    8d3279ee482928a1db7da17f0dbdbbc10c8b9677ae217eff4ca8f9f51bdd21e7749e95c51ac96c8d777f78757987a9fd75f1a5d3f51dbf11248ecbb91adf0340

  • SSDEEP

    49152:pkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2