Extracted

• • Target

    JaffaCakes118_ff5130d64fbb3dbe15cf06ca1bd28d5ab5983a5fe1af3b6354205b03021b0baa

  • Size

    164KB

  • MD5

    683f74e088d0049fb003a0e21ffc9159

  • SHA1

    b2e967a6b07fcacd50b26665e9c7cbb051e2503e

  • SHA256

    ff5130d64fbb3dbe15cf06ca1bd28d5ab5983a5fe1af3b6354205b03021b0baa

  • SHA512

    4eee32dd38697b6e28f17235aa0a020d0996cc22b35bb9bd9f46cec8c64f1f2b79394c183c21a2f30d6c9a7c3b5074ac29ded88693e6fc59d4c457a8e6ec3ff9

  • SSDEEP

    3072:vvsXt4/tRBX7iK3yV26O6a9vh5LTEnsBfQS9H6S:vkXS533OE9j0Ea

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2