Extracted

• • Target

    JaffaCakes118_1169ad7e7d5ef548ba83516573609de08e98c4b44ec21b9a85f38ff608ef2ba6

  • Size

    238KB

  • MD5

    9b58fb125967b2e13c612fd5914b88a3

  • SHA1

    64b1235daa9bf5626f103de55fbda99f07bd1bb2

  • SHA256

    1169ad7e7d5ef548ba83516573609de08e98c4b44ec21b9a85f38ff608ef2ba6

  • SHA512

    988e330b7ffad344211ad85aaf5e7a42efa9f922aa72ad7fa7ba15aace22c914d0e2af5557edfffbdc9d0fd68c180249542c99ba81f0883f8471e070b1d9f923

  • SSDEEP

    6144:G1ZQ7rqS/SWrdP8m/0B3GETtrLNCE9ZvKHy/o9:IZDWrdP8sET5L1/A6o9

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2