Extracted

• • Target

    JaffaCakes118_162dc8ca7cc9e517969a977e2860b6648602b6006491787d5d80001bc1518fa7

  • Size

    243KB

  • MD5

    3252bf56b75b465acbb31cc4dba7daa0

  • SHA1

    bb5e8c04d3f135e529777ea59afa9733dcdb9ae1

  • SHA256

    162dc8ca7cc9e517969a977e2860b6648602b6006491787d5d80001bc1518fa7

  • SHA512

    622d44a2429945a5c0820581654c9eeb2b41960f6c9f560dee3f86f6599be997ef58a946e90ac2427a691b6de6f45c77d8b404b3d507276867bec18c5ba7d56e

  • SSDEEP

    6144:XaZQFbqbPXvUCL7qa97wA5yao5ZYnuV8cKi3ZfM:qZxbPXcCLWVA57rk8Ct

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2