Extracted

• • Target

    JaffaCakes118_7b0ab20f77ec02d17ce7709082efc9fe

  • Size

    11.7MB

  • MD5

    7b0ab20f77ec02d17ce7709082efc9fe

  • SHA1

    9f784e9028d93c96b5891d32836e87190b0299f2

  • SHA256

    2fa9f901e9467db8bbf7def10e02da05257f62448ea69bbf55b0b9a834a88301

  • SHA512

    e0fb3b8903251973f6adb934fe3495fabc310c29d7a816c8f2ee6bb08652d11e62fc1544d0f268e481de073c586f224163313a850846b0dc2271b7e8e4a5f412

  • SSDEEP

    196608:LI++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++:L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2