Extracted

• • Target

    JaffaCakes118_b7fc34b820ed7dba076002a3184b3e3daf81c373561118247e36d0a526b133ec

  • Size

    271KB

  • MD5

    ab58855438cfb9ba9858155da922160f

  • SHA1

    24636dcae28bc4ccfcbe0a000105d864ed93165a

  • SHA256

    b7fc34b820ed7dba076002a3184b3e3daf81c373561118247e36d0a526b133ec

  • SHA512

    beccbedd5849a769b05bd30b24f140fd77bf9b880d3d6d3b0f41bb27607d146b89ecc05f19d2931a3d55a91b822c21f08e8e5591ea6df22bfce527f214c5ce32

  • SSDEEP

    6144:LlCFmeSE23mKALze0gCCyKgBjigjlfst0kUqfVHK:4wE23mKALNvCzgBjtj1sxhf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2