Extracted

• • Target

    JaffaCakes118_ac4b01f7584ce24c3e53d9b67355d4492837efb70c46fea6bb1b283c0bbf3c8f

  • Size

    328KB

  • MD5

    a73c813fc82d9241239cce8bcb32ec7c

  • SHA1

    dcac6a0e5617e9370d80abc63f1c7322b5e0326c

  • SHA256

    ac4b01f7584ce24c3e53d9b67355d4492837efb70c46fea6bb1b283c0bbf3c8f

  • SHA512

    a816ddf984550d3b19c3c42d0c620f6017a4793869914b33357a7d8b4fcec54edfe8d250ca04a64af2a686241af536a6ca42f3d3c78634244209116f9f37d23c

  • SSDEEP

    6144:w3VYRDgJ9dCwbNAJIZMVfwoi4YnbL+lKf7xUsDYXboo:oV0sY2fnbL+lKtUyYv

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2