Extracted

• • Target

    JaffaCakes118_2f09b78d9553e76cfb5f37d3b95c328c0e27492a41b053870c4cd38fe34cc313

  • Size

    310KB

  • MD5

    2c5389a25b8b4e41c9d0d9368635c66c

  • SHA1

    0b874b47a0b5b8c971a6750d35fd1eb081ab2df8

  • SHA256

    2f09b78d9553e76cfb5f37d3b95c328c0e27492a41b053870c4cd38fe34cc313

  • SHA512

    43f9c4aa667fad4f1d6c31af8c0cbed18b1e66d6a0596cd04d605714813c89e621f86dd369769c8f54705b10e2b7935f1e84f0e37e64f8258c4bfc7456b86dd2

  • SSDEEP

    6144:tSKVaczmP5HaPF4N3LnJSs0+2775wRLcacJj:tSKVaczC4PF0bJSsDVRLc

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2