Extracted

• • Target

    JaffaCakes118_1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

  • Size

    305KB

  • MD5

    3cc97570660f299ac6bfd71c41161d14

  • SHA1

    261cd155b045aa2aa7859839d2225e5fc85862c4

  • SHA256

    1b6729df427ddd748d46f7fe7c20e21b38f48a88ba4e56cd264dd715869c0036

  • SHA512

    f327fde63260752f8e69a6c2b0b775c829618165f6f088fbb9ecddc7f03df4804c0949c4f9d9f35b1cbeec0e32c9572eee017c86b3cf0814f85972cd05f46787

  • SSDEEP

    6144:eSLXimqL97bFsmSqhxg+EApS/irarL6MCOhxxFeTr/ekI:ecXuJ7bimSI80WL6+zxF6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2