Extracted

• • Target

    JaffaCakes118_cef42e263e7f019309f54211a3631a6307227afd9a14b2be82594d71401e943e

  • Size

    292KB

  • MD5

    233cbf353673f230bc6ac3dfc4ba231b

  • SHA1

    beb0d57cac314f0f6516cdc31e1e380982989450

  • SHA256

    cef42e263e7f019309f54211a3631a6307227afd9a14b2be82594d71401e943e

  • SHA512

    fb2494db2760b7381e0abaf7bc02660cd1780c57e0abf06ce6d21099c69109a3b4715fa87ab09c9293a82049b91a69318a6f8557b155c68bab2d3129a97b4418

  • SSDEEP

    6144:7gDFgfRlILqtqILeleWxIlUMNYji6loYTet/S6s/:7sFel9txrGIlUMNYji6jmS6y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2