Extracted

• • Target

    JaffaCakes118_e8775ba19c3e870f2d2b82ded8a857c1e398225c3cb2b3525d20e70441f9db48

  • Size

    238KB

  • MD5

    46b1ff10b780d1ce8d7be7ef3b86acb0

  • SHA1

    e4e1e2e1c964f498f1bb9227ed48a7202e7a45a1

  • SHA256

    e8775ba19c3e870f2d2b82ded8a857c1e398225c3cb2b3525d20e70441f9db48

  • SHA512

    c6b57a4091205920954add28de487ba5e103cfdf688067ecf6431a41ccd1398ec24277e478d4df939b1c2e6a984bba838747a8ab4cd978aaeb8de6a78fe0a256

  • SSDEEP

    3072:R7iI0UsrZRD2ALLqOju9/DyF6IZKVggjcGkNIVqI7sxkgaBChMpZa9uD6Vdyhkq:YHUsrZRDnLXu9GMSy7ITsq7igavwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2