Extracted

• • Target

    JaffaCakes118_a4408f6558a17cd4afad28613bfee94e

  • Size

    14.9MB

  • MD5

    a4408f6558a17cd4afad28613bfee94e

  • SHA1

    dd78fe50f4ea41ca7ae709506ea278d0968ec11c

  • SHA256

    8aed228f049439fe51a83d022609ff6f19e6fce22e6f8b5aeee41138728a7c1f

  • SHA512

    059cf5fde2a0577b358f1fe9fe638b401d80be35296fcdabbf28e79225c01b370f6d67e20ec16b052a9eda5f260812a61b9d9e20a9c467773a5aba7fad2f3067

  • SSDEEP

    49152:C7G0000000000000000000000000000000000000000000000000000000000007:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2