Extracted

• • Target

    JaffaCakes118_c18ecc99377a256ddfd4b6d77ee1d24f

  • Size

    11.0MB

  • MD5

    c18ecc99377a256ddfd4b6d77ee1d24f

  • SHA1

    1ed1af1cf166a964e232e6ac458b6c4af5ef0721

  • SHA256

    f6e70b26765b49fd6cdf53f9daf841d8f482ce48eb1a18134dc0a65ebc1f574d

  • SHA512

    440d63acf2d318ba3f16c7b5972c4bc86687b9077d268b3e34d03253ecc204c057046156894e69990427488e41e435273d27d2b6d30b4f1c7109552988596938

  • SSDEEP

    6144:zrZQVnJzxj5nP76vk7wQ6udJm1lzvGCUWlnpj:fZ2zxj5nPmRQ6QgjzOCnl

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2