Extracted

• • Target

    JaffaCakes118_846c64ed0a4502f5b189b257cb86c55e5228b6801e38eb992e5d5e3534d9d2ea

  • Size

    160KB

  • MD5

    fb35ce98c953322a42694830696a6bcf

  • SHA1

    4cddac04f1b0a724fb89cf6a8cf20aeb295b2126

  • SHA256

    846c64ed0a4502f5b189b257cb86c55e5228b6801e38eb992e5d5e3534d9d2ea

  • SHA512

    678938ab71f780a8ebf0e38f53ecd3351ba87524340141d58d273cc56ee0b6bad7a7b5eb8fc98918c58df5f3f45de8ab1776c08f6d4b06d85c8d2360d042133c

  • SSDEEP

    1536:0ae1ySgZv4PWNemwPvh45bxEmnVGgk1Il/01UmuhOgg8QPerf1G5VpJHh9H+/RHW:LVSuQTyaF2M1UxOzT6G5xB9ERHTClX

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2