Extracted

• • Target

    JaffaCakes118_6b1b9d0dbe7ab8cc243bf56a7beec0d09aa27becbc334d82b8b511bfd68b6e66

  • Size

    242KB

  • MD5

    2c68d9c4e5df87c3174b62feaaadd1b1

  • SHA1

    189b7c11c1a376add061d184774f42f9f6918dad

  • SHA256

    6b1b9d0dbe7ab8cc243bf56a7beec0d09aa27becbc334d82b8b511bfd68b6e66

  • SHA512

    3aeca678c39dbd8fa756ee07dbbd58b0a78dfb007d7afa8ec4a178927c479e827f939e7de6cd74db377b55954310d394e5627831ef77453b4d19b43a215aebf5

  • SSDEEP

    6144:2FZQ9Gib7z1rzhr6Za7CD3XtHgih7iFqj2GRW:AZQbX1rzh2DD39AqwqPR

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2