Extracted

• • Target

    JaffaCakes118_02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e

  • Size

    341KB

  • MD5

    edb174c9c6f39a28010ba93010e5fe6c

  • SHA1

    8524f85e693835b79b8b6826d920e8ac6a2fa022

  • SHA256

    02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e

  • SHA512

    c01e94ed539bb7f206597d23d0b0a35a9fb339077a4f8dcf6bc33e0fe3db1197d087a56cdee6ae7c4832ef67aa1f6974f852189f4e6058a40d9b5fa3483ba8c3

  • SSDEEP

    6144:GrAfPQiuplIecQmWBLRnGoB2fp1nOAaUK50q:GrAgHUeTmGLRnGoB2fKd5f

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2