Extracted

• • Target

    JaffaCakes118_cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6

  • Size

    316KB

  • MD5

    43d834f11fd8031dbcbba48f168447fe

  • SHA1

    a66fa5a150db13a503f7bbe61349e230b70200ad

  • SHA256

    cdb4cf1445c3d7c32de55258685d9565ea268d7ddca0d64cf4c8c7600fa039b6

  • SHA512

    6aefca2f0b7bb4c41f986a730c1e13ef8cd71f9cd0883ae29fe1330bdc3972e5a0fcc1f7782f2a69ad4fcd77f653551e4aa5f397b2fccb00447f03d70252fbea

  • SSDEEP

    6144:p5NbF5iFmK7Tm8krgjIENQgLFDJHjYWwftZ2mi3tj:8FN7Tm8krgjIENQgLFDJDwfk39

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2