Extracted

• • Target

    JaffaCakes118_34c46c275c84f9c8aa05c3399a1ee9bc

  • Size

    14.5MB

  • MD5

    34c46c275c84f9c8aa05c3399a1ee9bc

  • SHA1

    995251cca3838fb9a19ec7bdc2826e6b05dfa503

  • SHA256

    3a0c699dfd2818026b2685be853b6e4470501d8ea9c7126af16c6f3c62e8ccd7

  • SHA512

    a308a2dd4975dc2c41e8c8cb12af1a539b43997c150ebfb6fa0ef2e658127380c44c86b9e09878948730ecc4546f10957286de67251e45a876e003924d87ed3f

  • SSDEEP

    3072:p0dYxvqagQYPbb1gFlSLMU+++++++++++++++++++++++++++++++++++++++++m:+dYrYP1gjSI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2