Extracted

• • Target

    JaffaCakes118_b94d0e8435e9f0dadb6f683f7eaf08ef0917aabd80ab0c5ae38296921bc6d566

  • Size

    300KB

  • MD5

    4189f2a27dfdbdc0424f4b04964a1cb1

  • SHA1

    276ccfa3cef69d41b4ae7dfca5ca170a90d5032a

  • SHA256

    b94d0e8435e9f0dadb6f683f7eaf08ef0917aabd80ab0c5ae38296921bc6d566

  • SHA512

    55fd82b856ffcf1c0c1febeda8ce04ae4893a84d8a0bfb617fca3fdd1090f667f43aeb569857913e7a0e1388b769dd77006926a6469c23f9b339f06a7d705355

  • SSDEEP

    6144:+X5T4tWtxqDstWhZxQxHdEXhG904J6KkE:+X5UtWCDstWhfQNdKhV40Kk

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2