Extracted

• • Target

    JaffaCakes118_84383ee34a3b4ea76512141e7591aad60c1932d7adac69cd47ac8e16ef3a8111

  • Size

    242KB

  • MD5

    68060a28246b07b1497bf57d26c5647d

  • SHA1

    ad53b34a8a9789ea784975778d192d70b81aa35a

  • SHA256

    84383ee34a3b4ea76512141e7591aad60c1932d7adac69cd47ac8e16ef3a8111

  • SHA512

    a73529a2209373b88cd5dce6d22061bdbb28f419a93531f19222e7e5bdf496ee07adbdc76b7aea473370374f36fcfab1993d4114901e283618c5da139158b700

  • SSDEEP

    6144:LGZQQCr8GU7oXgvogF7QfhuGDN1x5AV0mV9caD:iZL17oXgvwfh75T5+VV9c

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2