Extracted

• • Target

    JaffaCakes118_70f65b52920189113e1ae0506801ecb171397fb98b092ebe80ae5c683d479934

  • Size

    238KB

  • MD5

    59495123890f405379efb2be1f540734

  • SHA1

    921d2c24a21fdf66e0146b406e03a14922423b07

  • SHA256

    70f65b52920189113e1ae0506801ecb171397fb98b092ebe80ae5c683d479934

  • SHA512

    78dbfbcc4c6be158e698022fdbaea8d4b7ef3a63b8b05e0fa93cd3186f63eddba7dcfb3d24bbe11dd199420ec530dc0c8eaebc81121ebfdcaef8eaa839d69643

  • SSDEEP

    6144:qzNQs30ECx6n19V+OEpr5d7ITsq7igavwVf:qRQs34x6n/I1d79

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2