Extracted

• • Target

    JaffaCakes118_fe8ee365ed1f5cae302130b5fd5b3e069f91a1d10c94d53cdf5dd6c1db266afb

  • Size

    271KB

  • MD5

    3f65dae6305ca843e7b9b7df2f74d838

  • SHA1

    2c44df4d74900d500dcf9835f6c80ff84d268a37

  • SHA256

    fe8ee365ed1f5cae302130b5fd5b3e069f91a1d10c94d53cdf5dd6c1db266afb

  • SHA512

    93d1cd17ec557a46c3ac6b32a08d24ec1c8dd26ad3c5e2fbe7c4a9c7ce7d2ce568913844d18f950d89a05b22ff76b528ae672b5fbcee8e35da41eb49cde43971

  • SSDEEP

    6144:DgfpPeqotkXALxePgCA0+A3Ii4b6gvlVUgJ:kXotkXALQvAi94+g7/

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2