Extracted

• • Target

    JaffaCakes118_6e8c5874269f258b6bff19eec8e04729932626f6edb7e61dbe564f3cc7255cab

  • Size

    167KB

  • MD5

    249fdfe48e87781f9afc019e32386aac

  • SHA1

    07cd4328635c81f4884a63f84b6bfd0e307a61ae

  • SHA256

    6e8c5874269f258b6bff19eec8e04729932626f6edb7e61dbe564f3cc7255cab

  • SHA512

    f5696faddf8edd51f04681c391cc6c92dd0e66cf80c521134b472de6488e0016a9b3958d6e0de6cf61c6913463dea053c8c89bdac74a26b8d9b2289c418f5377

  • SSDEEP

    3072:P9tPi1h6wejM/fvv0qqgikN3KAaf5gitpr6uerWcCS9H6dY3:l5i333/fGgizrMCEad

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2