Extracted

• • Target

    JaffaCakes118_ee8971669604d991bb835184b977c9d2c7fb8d24da37d4c4006e12719578b121

  • Size

    164KB

  • MD5

    ef9919f9069d7dbc5dd623483cb4cab5

  • SHA1

    15dc95800da86f01c4ab3461f5d1549e3804d490

  • SHA256

    ee8971669604d991bb835184b977c9d2c7fb8d24da37d4c4006e12719578b121

  • SHA512

    af859aa71534c3359e6dd88a86239046b34c43809a6cf35a067ab2bb114b509625f430ff7c24ddefbd5b16802cd12095cd224801102985607e3f73008eec9698

  • SSDEEP

    1536:jJI8UMLeRaE1C6XYLrh8PLTCJdFoCEhpgtXsP+qrdeZQ5rRzBOGGtw1arhK5AICp:j1usACEj6Wz316K5LVau9VS9H6l

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2