Extracted

• • Target

    JaffaCakes118_11d49902844ec882859eb77c3290075e777b549160f222a3b40223f2f46c2ced

  • Size

    291KB

  • MD5

    780b60facfcf100af7a2d30da62ddf3d

  • SHA1

    17c31df57ed29494f39b0091e7ba3fe459018644

  • SHA256

    11d49902844ec882859eb77c3290075e777b549160f222a3b40223f2f46c2ced

  • SHA512

    87828565200be79a86d401bdb5a30d063171c28de7bc030baa29d03a3dc2ac9d6d1b38c3b6c0a41c5f998d1c7b23891a6075b0d810d097670e8a41c0d928f453

  • SSDEEP

    6144:M6k6SmTHN6W9Blk5gi615mof8WBCAb81wp:MZFmN6W9BlYgi6DAiCAbA

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2