Extracted

• • Target

    JaffaCakes118_179c4136313e96b23012cfee257ba651a66978b927e22e5d743b134f2b6cef90

  • Size

    179KB

  • MD5

    501ef445a28ef57d3205f55a64722783

  • SHA1

    90b149f89b249717d5ead8ba9405a61b964b9c4f

  • SHA256

    179c4136313e96b23012cfee257ba651a66978b927e22e5d743b134f2b6cef90

  • SHA512

    45a86c997a4df23c6426eb0439b8b540d1b50417715533804f1c162ab67c9101e706de527f5b552fc937104fa4bcc19d7e6612a30f514dca91365101d92e0ecc

  • SSDEEP

    3072:v744SpmfTOqH/16n6y3T+Lsnxw2ZdEeslmXQLES5y:emfTO0e+YvOdl5AS5

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2