Extracted

• • Target

    JaffaCakes118_6f116c643fbb82bbfd2cb550b35d446b55038c234b191c8b75a43612effc6663

  • Size

    279KB

  • MD5

    d32e3e8115f3c17716d37df5a2af78ee

  • SHA1

    1a617fabdee37f4ac34c8e200b9e52268bf72c28

  • SHA256

    6f116c643fbb82bbfd2cb550b35d446b55038c234b191c8b75a43612effc6663

  • SHA512

    cf6a6518f00f4ad093c05e4ffb393ec7e02319a535d0c7fc4941894d90fece8fccb474c48cff6c9b26b440b16845a123b21aa689e2b2368a91e4c61c1a9ac5e3

  • SSDEEP

    3072:e0Zpg7yAH/XDFeioco+MNF5+aBXIynv1VdzQyU2PkbZvUJKYg4Fx2d01Duw92u0U:Atop+MFNVGSkbuJTh2dyyj

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2