Extracted

• • Target

    JaffaCakes118_4b02b5efc37cca1c519ee86f00a210f7

  • Size

    13.0MB

  • MD5

    4b02b5efc37cca1c519ee86f00a210f7

  • SHA1

    c15d7ee674c4373e5e8c517e581e5102c6cd4416

  • SHA256

    ebe61355e05f3920d077495ca302afbabcbbad760c13f14d3b3d1e8c8dedfaae

  • SHA512

    a219b35b48bc6bf452471d2b265eb59ad6b40f79dd7a265be8c1c99ea145dcc108aff2ec4908e586acb00473ea113cc8ce001ae3beac5e3db015b9f214bf1daa

  • SSDEEP

    6144:fKP2GmiErAKEjgoUYRxiPnkIW2p6/hR6bPz/9hniF:OdEkf5UmiE2pagL9hi

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2