Extracted

• • Target

    JaffaCakes118_0bca46b194fbec1a66fd4ab15ada451391d18768be02b5dec4d18eb2a32e5832

  • Size

    165KB

  • MD5

    eda8ef4ef88c28ae99753670669cb75c

  • SHA1

    782f44532a57ab15a38700d8effa6ee91329119e

  • SHA256

    0bca46b194fbec1a66fd4ab15ada451391d18768be02b5dec4d18eb2a32e5832

  • SHA512

    c8ce8416f4df3d49875acd4048881e7256eddfb27d787f51117d91f6376e04b2bf34446fba7ea9a86494d0f24a68a897ab94e68bbb9481c1869c6b794cb8f899

  • SSDEEP

    3072:yHecR8524Pj42v7XoL/d4TcTyB9rmqk88RgZA/72:TcR024PDTXm2B9Zk8kgZAK

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2