Extracted

• • Target

    JaffaCakes118_1a738fafd9d63b35e2235d6eda9a28f5

  • Size

    11.9MB

  • MD5

    1a738fafd9d63b35e2235d6eda9a28f5

  • SHA1

    fbd3dc9fc9b476f51de8ae1323b90bbc0a299437

  • SHA256

    ca2899571b116e1c462f0d68480865f3f694e95a9b16c45af44c28327197d593

  • SHA512

    b205d1f591831b1608f88cfd44270e3a7460fddab4bc38ba2829d8a7f52a42a10847c513a20b9757b0ca0b523ac76e75260a45f1be8d11d49cd376f479ff6125

  • SSDEEP

    12288:MjjTPaKiQnJpVAwyCubY4ud8rf/444444444444444444444444444444444444v:ej7aK7Jpd

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2