Extracted

• • Target

    JaffaCakes118_46c88105604822a7742e2ba3e6bbe972348e37c559e9b1c7ed87cf8995db57ec

  • Size

    355KB

  • MD5

    0705d8a26643fda3847892650df6b7fe

  • SHA1

    98513720a0866476912fda3ae473292fa02e1a38

  • SHA256

    46c88105604822a7742e2ba3e6bbe972348e37c559e9b1c7ed87cf8995db57ec

  • SHA512

    1fc018bf6e9aa0eebe4164b4c18849fa65b6d97c5a93901c4d677f40a815454ecea2066c93fe7d9f3767e9947117baf4e7218a7f8dab640fd9929242142253aa

  • SSDEEP

    6144:sXwE2Igd4E7jIujAab5azd2ne001GeyOoYDXVQCVyXFEL:sAEUMKAab5azd+e0MGeyOoyVnVyg

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2