Extracted

• • Target

    JaffaCakes118_e21181a90f076b9e930a523bce604588

  • Size

    12.0MB

  • MD5

    e21181a90f076b9e930a523bce604588

  • SHA1

    240a200e30ad73dbe737ef12ec5fb2863603b3ad

  • SHA256

    31503bdb8b3ee9da6bb91ada24ebe560d7e5edd27b9f01c53f0afce48ceedd55

  • SHA512

    32d458f689fe9f5e32c06e5d0308c6d7d0f4616747f6043458548615fc780014bf031e327e89a0a16fd013ebee0fe76fb2afbbc9c75d1a87f01c673db555ff4c

  • SSDEEP

    12288:lZv3F8h86NMcoGuc3FXE4WrIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIr:lp3F8Au3FPW

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2