Extracted

• • Target

    JaffaCakes118_836c6bce97be22e9866b1a0359dd51e2244739193cfc3ed71f40e36a9e980d69

  • Size

    187KB

  • MD5

    84a622e66ce8a6be78794bb4ae7b73af

  • SHA1

    a19e48131196c239779d6c1fa475ec9c19486619

  • SHA256

    836c6bce97be22e9866b1a0359dd51e2244739193cfc3ed71f40e36a9e980d69

  • SHA512

    5bd009834fe2851aaed738d6f9a8762f5b56796edf3b56d44c82dee62e45b4c629c68f8001a28d39c0a90a8c2e59aa7faff7b720d9121c4effe461e5aca480c1

  • SSDEEP

    3072:Zx7HITMYRZawv2fas1CoDpN/k9mMb122xhZ3kRtqI/nhcpZa9uD6Vdyhkk:ZZ6MYRZawv2fasfDppk0c1zhAtlKwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2