Extracted

• • Target

    JaffaCakes118_633916351d1724c5dee57d31ee60adb6

  • Size

    112KB

  • MD5

    633916351d1724c5dee57d31ee60adb6

  • SHA1

    fddbffaf67742208cad9036564acdae7520d3390

  • SHA256

    1f6a39c4520debfe0f31de642611dfe844c67eb5fc7b4af138df9c6b191a14a1

  • SHA512

    32364dd7dcda32dc3148bc724282fea427494eaa3045096749f68479cd7eb3c2842290cb72b9de0c33965d453cb4792ee17874d6b27f9238cecc2e968afb1977

  • SSDEEP

    3072:gjgRyvXEFiKfQ15q4Qe4FVwtwwgs4XBcO4:HRGX4kC1eZ6w

  Score

  10^/10

  tofseediscoverypersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2