Extracted

• • Target

    JaffaCakes118_9c07c1ee178300be5ef12f1c51cc3d5d574499b4f977d6bfc3314701dae0ab7d

  • Size

    187KB

  • MD5

    4456628ee52545cbb91c3588b327a1ad

  • SHA1

    a699b0f6d3c4b451f40632d82f55659629d832b4

  • SHA256

    9c07c1ee178300be5ef12f1c51cc3d5d574499b4f977d6bfc3314701dae0ab7d

  • SHA512

    dd60054847d9c91f0a22e10eb5e1aaed977d871ef077eb8c033239311a11f12a467f81cd96609f3cdac01a5c70ecaddfb37397444c84d4a0a70c11a710a3b987

  • SSDEEP

    3072:T7ojA4DTPiETuihAgpJrI0EhQkL7I313zQ9J0YgYpZa9uD6Vdyhk9:WA4DTPiwhAV0EhQqm13c9J0YwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2