Extracted

• • Target

    JaffaCakes118_9c091435e90c9aff994ec6709d3ac5ad

  • Size

    11.6MB

  • MD5

    9c091435e90c9aff994ec6709d3ac5ad

  • SHA1

    8c4671dccf4e9af24cb39a84e6208d1a034df8c4

  • SHA256

    ac7a326d4aee82560990e2a18d311eb56c0c2d4e4dea0a712b27f7041c809c86

  • SHA512

    08cdfa4e9eb3a2bcb220b29c8ff2656f01017567a305eb5e532adcf84a83d3483ef9f9aefca63020e822742a0199f9d77e76767cff3d00ac0d003c54434a5edf

  • SSDEEP

    196608:6MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMX:6MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMX

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2