Extracted

• • Target

    JaffaCakes118_acbd0cb684e9de0adb01111e9bbbc1eee0152946829aae3325c9ab9741bc33f4

  • Size

    166KB

  • MD5

    c98ac74e312f4db649bee71480ccd6fb

  • SHA1

    6344d3f82ad4f1ca3a0474ed972865267e11ad4e

  • SHA256

    acbd0cb684e9de0adb01111e9bbbc1eee0152946829aae3325c9ab9741bc33f4

  • SHA512

    eb037e296abcc88db7e804096ff1eb68303c9694d4ac41356f0656050acc9fee0b5a7b1a8f7b1b58759942ec1430e659b03cf241351a659394a288d4db2c122c

  • SSDEEP

    3072:eaMIRpw+UbMXI/C06vRLzFZ/S5XJNCa5xuv+fXyX:RxUgv0657/S5puW/

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2