Extracted

• • Target

    JaffaCakes118_82e5672e4354e66588d70ab01d6323a07e88e3acab3fbf89b3866982a50f3721

  • Size

    243KB

  • MD5

    0fba569148e3b4758882dca911ad7fa8

  • SHA1

    09c8755dfe3f733d5deaafe60ad92b47907f7d9c

  • SHA256

    82e5672e4354e66588d70ab01d6323a07e88e3acab3fbf89b3866982a50f3721

  • SHA512

    4af517ba9d0b30fe49bbcc69adc71357f2c19b48870366a97f8c1a19627ecc811233cac98395a16694cbc2409f1e85d921e14775507a42c36d491013faca681b

  • SSDEEP

    6144:DQZQphhKlXyYNadG6717PUJN5xmCos7SmQ751CetXH:sZDXyYNaT7cHLosSlh

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2