Extracted

• • Target

    JaffaCakes118_1b5150200509334e86b497d0eb143cb0

  • Size

    13.9MB

  • MD5

    1b5150200509334e86b497d0eb143cb0

  • SHA1

    5ad9fc641d3c4c8a11aa8132b9e38b4a900015e1

  • SHA256

    38b1c41c5fefba7748d9c832b2f2ad6223a37f27afb3eb8b72f8d16bd30cbf13

  • SHA512

    18429d3d9f0c7070dbb10902a0d5d8547442d4358f2627f6247b3244b04850d652ee6766d88a1e6dfac4e908e8e9087157500d63be26b9020f884ea00b8b764c

  • SSDEEP

    49152:2yzapZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZh:2C

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2