Extracted

• • Target

    JaffaCakes118_47da2b60d36bad5a151d449e854f8b9588f78f8c7d981f214e97e767ec17d119

  • Size

    168KB

  • MD5

    b6694bc1c3470e6fa42b39e1fce2cd13

  • SHA1

    0762960e9f7c2277618a98869e5cb9921112aa88

  • SHA256

    47da2b60d36bad5a151d449e854f8b9588f78f8c7d981f214e97e767ec17d119

  • SHA512

    b5b0a4d411d020df94b749fd4d103edd0fe40a320e64a77314aaa6230c47d8f308242dda6a3ccfcb15138e5e372025091eba5dd53c8707ea7f2733ec84a8e4f3

  • SSDEEP

    3072:2Yx0uJ28EQFGlerSmgPxEquAct5A4b4CpSmS9H6dYs:90uZGleNW4AkBEad

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2