Extracted

• • Target

    JaffaCakes118_6fe5a2468f7bbeeefe3f4d9fd050dd084b52ea280616df2154f355abafc73fc2

  • Size

    299KB

  • MD5

    9454fbf180ed335a5499cd841784bbc4

  • SHA1

    7b385037ceef8e6bc0f319fad954e7769e4689fc

  • SHA256

    6fe5a2468f7bbeeefe3f4d9fd050dd084b52ea280616df2154f355abafc73fc2

  • SHA512

    2610fd4b948ad79f5f2256bdde3439cc39b76603c7e5edb92ebe4601b368dd74d7d8b7b1bb6fbed62c9a4999d7ef70c8c6d75486347cbe7b2e68a7eadafea9f3

  • SSDEEP

    6144:EpE3/vjto7fBz+ofNp0enjF37k90jQ6y6QOqLOR:EUnj4Zzdp0enRk90jQcQOQM

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2