Extracted

• • Target

    JaffaCakes118_4e370c11ec3d5490a4f08c8f25219cd96b3098e619380317bf92d04e8374ebf2

  • Size

    146KB

  • MD5

    f5339fab992d8d5dc0e4106fb8b5b899

  • SHA1

    cf0665860499961a9f5e1ef8d878b79684f8dca2

  • SHA256

    4e370c11ec3d5490a4f08c8f25219cd96b3098e619380317bf92d04e8374ebf2

  • SHA512

    22f068ada213227ac68c9d285331a0bbb82284c9dd73314a0df8bd5d9e5cf467c655efb3bf62d67ef5eef218b2b517c2b83e6e861476524dcd431cf4f164e370

  • SSDEEP

    3072:yMh6zd/diHv43x+rCV5EJLMhxZG/qfPJA5FHJATz:yg6R/dkv43GCP8tqf+5FGP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2