Extracted

• • Target

    JaffaCakes118_4c07ca13d4b55e7b3d847d37d0fbc387

  • Size

    12.4MB

  • MD5

    4c07ca13d4b55e7b3d847d37d0fbc387

  • SHA1

    77c5851c82d2dbba05c72317cb4ed9917aa45654

  • SHA256

    2916efe4ba63200798dea1fe33a121c3e4c368bde3508df6bac75df00e6e164f

  • SHA512

    ef0f0c744b1629e6d0aed9ec94d24d68083b52ea3784d2243723254ad51c02ed77a4c016a31e6c641d28f16773dfca3e17a465d5e6789bd94beec321252ed212

  • SSDEEP

    98304:fY3333333333333333333333333333333333333333333333333333333333333n:f

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2