Extracted

• • Target

    JaffaCakes118_fe6cad6786c9baa0def488159be9fbdb1b149503688a612f6fc2006e79abc665

  • Size

    238KB

  • MD5

    f86417c2fd815b961531de373e216cb4

  • SHA1

    c469621501cf0b9f1dda7a6fa94ecbf715c32d92

  • SHA256

    fe6cad6786c9baa0def488159be9fbdb1b149503688a612f6fc2006e79abc665

  • SHA512

    9a2e75bb0f18989552226483952ce036796e08f9bb591e7c6c72cefdd638d4dc6fad1036be767cc7cc5da2828880e483a3e39a30f6210290e5d9148793e2b6de

  • SSDEEP

    6144:3SgA7fIyTlO/L/xYZen+7ITsq7igavwVf:3XA7fI2lO/L/xy79

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2