Extracted

• • Target

    JaffaCakes118_1ed0709942f40ec6bdb7b1278dbd6e9d

  • Size

    11.2MB

  • MD5

    1ed0709942f40ec6bdb7b1278dbd6e9d

  • SHA1

    a80ab46b8c0b7464ae01d19bfb1816f2f17373ce

  • SHA256

    e12f4b91c2032aa459faad30f305a81e1aaedab6f2e04e05e91740d714ad9c80

  • SHA512

    f97fcfef714cab32ff89840326a57e9e6892bc4643fd94a22321d9f520c546533ecc721a4d65968d19071ad2d98c2babd9214936f8fb38545c3cb7663db7b3a0

  • SSDEEP

    49152:tN5555555555555555555555555555555555555555555555555555555555555/:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2