Extracted

• • Target

    JaffaCakes118_f647a6fda0523d4891a6c0805ce3d432e4e73b5b78baf4df701ebafce13899c9

  • Size

    169KB

  • MD5

    29158e8cb0547c4acb9b1f3943dee654

  • SHA1

    a0e09de29d5b1e40956e98f896283c2b1981c3da

  • SHA256

    f647a6fda0523d4891a6c0805ce3d432e4e73b5b78baf4df701ebafce13899c9

  • SHA512

    e322f101af58092c980387442bf2abb43f7c167d430e94d46d4aaf075c61650b69266b41c99622b794db08a33915de49e2c21e1098060ba694aa20ef4397bec1

  • SSDEEP

    3072:dINEppMfh7N5IC0UfQDCmiTPOKtGtJVA8sxo2:KNEppMfz502jOEAfA8aD

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2