Extracted

• • Target

    JaffaCakes118_19c9add646a90d6b1c70e042d50a3ce3da3c576bc4e915958fd759291f71f573

  • Size

    141KB

  • MD5

    e9e3aba9f2284b54073f08fdf7c28e59

  • SHA1

    0c5e5d05dac2bca6e05d8516ad8a789b87c4745f

  • SHA256

    19c9add646a90d6b1c70e042d50a3ce3da3c576bc4e915958fd759291f71f573

  • SHA512

    129ff5061a607209b2570fd14ad757fd690c205cc9dbd3ed3e9c4123c29dc3e8cd400958a7469c55f9aea45a9db09e4e2854683425ad6cd9811f078328c250e0

  • SSDEEP

    1536:s8EcWv2ZfLIPL+YqZcM3oFlf/mv9Kz3TvayvCNAVZYIpiLj5/ICTop8/1j6bqa5c:rTZwM3off/mvAauCNAVOP5QHpxTYQ

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2