Extracted

• • Target

    JaffaCakes118_abae387019fcd635f8ae3ff49ab229e7

  • Size

    10.6MB

  • MD5

    abae387019fcd635f8ae3ff49ab229e7

  • SHA1

    f094288ddd33aaff716328fff79fc453f2f4180c

  • SHA256

    92342ec75f66155c2510cda2f0834da03a26f188562dfe6838ba84844e8456b2

  • SHA512

    4706a3e0a98f53944a812bd27f9f0d0bb16abcaef670bfced628140dad791825700c6bc3262dba96badc927b264ce7bbce19539f92cfd743b03a2cda546b1456

  • SSDEEP

    3072:S0dYxvqagQYPbb1gFlSLMU+++++++++++++++++++++++++++++++++++++++++L:vdYrYP1gjSI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2