Extracted

• • Target

    JaffaCakes118_6d2c4d0bb3c69b3ef5c0580bf12811c0

  • Size

    12.5MB

  • MD5

    6d2c4d0bb3c69b3ef5c0580bf12811c0

  • SHA1

    ab43ca8fabbb2dde3b73faa2bb6c6ae49c119345

  • SHA256

    c466c81252bad216e977913ad8ca17ba679e9e3face818c2ba85bb8bbc5a9346

  • SHA512

    73c5cdde6145fd1e3c13e2e993482c2f5611db339ff6e91ccaacbc7a0bbc02f80a4b08278a342abb64b9a44f04a93b9381f75237d9a93ff1a29dafd50268f2ec

  • SSDEEP

    24576:1/FfqVdOBr70Fm09999999999999999999999999999999999999999999999991:RFU

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2