Extracted

• • Target

    JaffaCakes118_d4f26d3820d12d559203afb74595449c5098c7f3d692284a0eab05d8e2e7a034

  • Size

    287KB

  • MD5

    416145a7704107f66a3d8a498cc69bf5

  • SHA1

    0a9e964946607de5c7043ddbcb7d61a9f2c16b04

  • SHA256

    d4f26d3820d12d559203afb74595449c5098c7f3d692284a0eab05d8e2e7a034

  • SHA512

    3a22738f17ae0a1353aa4c309a5696c6fe8e9e14c124578e1c56c09fc73bd34d800183df59e70567dc5076c5deec7325f55c2b3addea995faa4210d27139ee7d

  • SSDEEP

    6144:pTAn1CWp268ehhPaIB1vVtcL30TGBi25x:ZAIT6BhhPxB1vVtO0TGBi

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2