Extracted

• • Target

    JaffaCakes118_58752562c0472e1ca8366acd6edf883e0ad1a3ec78ab97500c64f4f76f50f479

  • Size

    286KB

  • MD5

    89e8a1b1e5eec9b15314df6c8232406c

  • SHA1

    7c088ba07bdfef0f3f427cc400ad2237ffc2d331

  • SHA256

    58752562c0472e1ca8366acd6edf883e0ad1a3ec78ab97500c64f4f76f50f479

  • SHA512

    f2d8805adcc2c2b90efcf669323e1f07ba4c4e18d5bdfbb213148447b468c07474692fc20c3d29dc545c63196d433a7d69118aef02781056e8c2b2544bffccf7

  • SSDEEP

    3072:4I9LYEcdxT6FjvfOOlKBFUZHsu0ay/M3Ve2RU1Ujo3RNsPI6MPepmsIm5ejH:40LsP6FjvFlKbyHq6yz3RCIOUZ

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2