Extracted

• • Target

    JaffaCakes118_d3758575fd9f846d85b214009243fd7a

  • Size

    12.9MB

  • MD5

    d3758575fd9f846d85b214009243fd7a

  • SHA1

    91c5274faaa9c810fa7ba8f546cfe8ea7a3b4465

  • SHA256

    6063cdcff6aef2676a221bd82b052bc15a8ae10f4eec04dade0a454220c7a732

  • SHA512

    7bbbbbb36646bd75f84d9d0cdc79fc920004902c4601789fcf5330266a2ed3f7397b148875ebb851fb868188ce5831dcf7be5cca34ac68f9fbe55617c05e2c3c

  • SSDEEP

    49152:67G000000000000000000000000000000000000000000000000000000000000c:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2