Extracted

• • Target

    JaffaCakes118_26e137a7637690dc59d8e8a2d021faa1

  • Size

    13.3MB

  • MD5

    26e137a7637690dc59d8e8a2d021faa1

  • SHA1

    c886d75827062fb557ffaee27523f99ea757a9ed

  • SHA256

    1822fa2ba4aefbb104ff7ccc5cda7f369a25cf016a1a3eca55c16bde2ceb4b94

  • SHA512

    9f0efed008a315698a4a1b7127ad4d5d1e4d370c4299391478fff22f37bbb44df2d5d8d768e87c1a58cf9bcdd41d8218b4032eb9de4ae82ed7f6165676d22cb6

  • SSDEEP

    24576:pAWcGx111111111111111111111111111111111111111111111111111111111/:pHH

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2