Extracted

• • Target

    JaffaCakes118_d3d822be312737cc70fbc680cc2bdb7806846b8fe74df7f5cb8c4720cc332cee

  • Size

    236KB

  • MD5

    d56c8d55c3de102b93d2de0977675269

  • SHA1

    47fc8dc61ec75e3fbec90df6f1260382a7d6a4c1

  • SHA256

    d3d822be312737cc70fbc680cc2bdb7806846b8fe74df7f5cb8c4720cc332cee

  • SHA512

    70561bacffc5bf31e0201d4180053f2be081093f89061a3daac0bd8110bfd59b1cf1f5b1204997b3bbceb032f59a151138377203912355c423e424fd8e35091d

  • SSDEEP

    6144:x4Gu7W6nYZOlOH7OxP80PtqJLr9tamsUKPfRYw:xv3YYslOGP80PtqJLr9CvZYw

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2