Extracted

• • Target

    JaffaCakes118_8ccc2337fc52470557a28e597122bfd6b4216f86a478ab5300ecc09432a17d30

  • Size

    319KB

  • MD5

    12ba89f5ac89a6addcd1f15b1c16af05

  • SHA1

    a8e8095cb2e1fe8333e86c6315703c56c76f5600

  • SHA256

    8ccc2337fc52470557a28e597122bfd6b4216f86a478ab5300ecc09432a17d30

  • SHA512

    4c950848fc6af3f2854da5856717c7f150222378547962f91e9a61c6c7fc91eecae9bb12c53b36581fc99fb15edc10add4d205ec367c4a2e6a26bee2d1f8d4d4

  • SSDEEP

    3072:Uxyir0spfxtTM/B0OgS7NHfzlngAq0zSRytHb6GG+OX9qqyMg3VkPyiRXQi5bFs2:O1tSTgS7xLBTbzyytH22OtZyZ3ViRXc

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2