Extracted

• • Target

    JaffaCakes118_82939f0d515a95bd2bcff9704a3526983d1887930bd42676cb477e4566a5f9a3

  • Size

    260KB

  • MD5

    e7d738f6e1345dab0f39cc246f252a51

  • SHA1

    047a32c253e10070201ddb8c42559f463279c08a

  • SHA256

    82939f0d515a95bd2bcff9704a3526983d1887930bd42676cb477e4566a5f9a3

  • SHA512

    7bcb0e1b8a39d9e36cf136c0fe7b330e0cffed1d9ef9b8746f8edf260e46e7ec658ed24ba1b810f474d661a06e8d579ebffdbc8c3d811efb23d61b2bc6fb829d

  • SSDEEP

    3072:Q4iCVSdVB63QbxnVIFgy2Vt19Itux5sVggjcGkNIVqIOM/h38RaoBIGvj7:PxSdVBAQlnVImHtItuk7ITsqx1awb7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2