Extracted

• • Target

    JaffaCakes118_9c4dd198c1fcf7dac80b64a82f4c5b72f83441847ee772de5016d634154b4212

  • Size

    316KB

  • MD5

    87a58dc8ac5becd9f987e106a98965df

  • SHA1

    d8f43dc14b3947098acec7a6252dc559324acf00

  • SHA256

    9c4dd198c1fcf7dac80b64a82f4c5b72f83441847ee772de5016d634154b4212

  • SHA512

    2b024787793cd31a8b0cf8bdd83c3b3bc7534f6bb0cbb110d9a2b2253dfc14de45b5a7cb051d4befea4daf0e83e6f267828c48a54c66b411468b4518d1bc445a

  • SSDEEP

    6144:gVhnD8gVlE30L2ybuj67CZ0jGv2Dq31jsoQK7k:0E30L2ybuj67CZ0jGv2Ijs1K4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2