Extracted

• • Target

    JaffaCakes118_abe6eaf7211e7a3ae2e7d9423fc6b1e5630553997b5db66b262b4787551a2d71

  • Size

    355KB

  • MD5

    88ba98960a3b30e81fb3d948b661ed84

  • SHA1

    c8e781320a252700b28840f1ff38452a20fada80

  • SHA256

    abe6eaf7211e7a3ae2e7d9423fc6b1e5630553997b5db66b262b4787551a2d71

  • SHA512

    f4d23150eafcfb36750a90c82f499998f01712a0e13a6fb0dc8f0ea67e5f88d6645ac3f07d8b2675afddf9a2120e6e5f7cf5f0f4f02b3da41c3e2182bc87f192

  • SSDEEP

    6144:W0YpGCXDz6cJUetcbhENT7mLzpllRbzOt0A1Y/y/YYJoeQWai0RKcJS:WTp3Dz6cvebhENf+Lw0AY/y/Y/ePaiiZ

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2