Extracted

• • Target

    JaffaCakes118_0d2e8b13e996d58447a95e7b8b5918373000d6baa78c33c04fa67a9ae3efa871

  • Size

    179KB

  • MD5

    1ecbcffb32a874d05b2d4e9ac19b9827

  • SHA1

    3397a30b7ecdde3effb329b7bad29fdf074a63f2

  • SHA256

    0d2e8b13e996d58447a95e7b8b5918373000d6baa78c33c04fa67a9ae3efa871

  • SHA512

    24e188516e1b32169d9974300da435492e6565d4489a114a5a3986f65efe897822cb0d602bdabe22f79b5bf3aa5b6c899f70d39f61cac313726647f0e27e26ff

  • SSDEEP

    3072:B7S4EKeM3KP5fooZ8+TiX5SsiduZFG7XNDsUpkV:7eM3KPlFmMsbzG7X2Up

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2