Extracted

• • Target

    JaffaCakes118_b91cadcdb2de363ca86892d7ff8976eebc3caf201eaf17677e7813ab28dcca50

  • Size

    157KB

  • MD5

    8006480396403ecdc3dfba652f72625e

  • SHA1

    2bd56d6ced8bbc55eabe903e40b0f379588a17ff

  • SHA256

    b91cadcdb2de363ca86892d7ff8976eebc3caf201eaf17677e7813ab28dcca50

  • SHA512

    c6a579c80c91b6ee7e08872b8c2f8c4d469e7ab53e67c1270920b0e3006c9ebf0ad77c9dba7ba05857f060bf15de2f4c22a618b874fc35363c0d9446d1a59290

  • SSDEEP

    3072:gSxItjItvER8RAVljfk7PwaKhp3iyqH5+:dIG1S8AfzFaAy

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2