Extracted

• • Target

    JaffaCakes118_25312406a1a4d9a3aa19b758b18135384469ea8cb90f6c59773e953ff58b6cba

  • Size

    272KB

  • MD5

    258f12b30b5079201fe2dd01fdd9a5de

  • SHA1

    1828c389ca0984151cd775bf327a56c0fcf100bf

  • SHA256

    25312406a1a4d9a3aa19b758b18135384469ea8cb90f6c59773e953ff58b6cba

  • SHA512

    d365952ce8942f63da788f39511f411927ccd293469edd2ca449985883d9be792136283a95d1b16c8626c1fa4fc3e31acb0a89b21816cb17a7a00f18f821c271

  • SSDEEP

    6144:z7Bf/u+LA9m+NpVuzbgwu6L7ITsqSigaTwVf:Bf/u+LA9m2Vunnn7s

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2