Extracted

• • Target

    JaffaCakes118_c49c72803c00204619f091dbe68e20c77d5bfcd7840134abbafa37a168500873

  • Size

    254KB

  • MD5

    308d72a6ab750bb644ade8ba1fbbd53b

  • SHA1

    e57b214def5be0f41fc93aada38954f79b705f4e

  • SHA256

    c49c72803c00204619f091dbe68e20c77d5bfcd7840134abbafa37a168500873

  • SHA512

    03531979a92ab7f5a9de753e8c11b1a8263c6b3d4e461ee2246386ddbfb10dfec6d67eae531c326c447b73fe1b6136f25d1419c5adc229c3595cf78da76889c3

  • SSDEEP

    6144:EvzGRGQGlJXwcXXqMaul4TFOoJyDIEMgUpSulOP3U:ErEPGlJXwsXOjTkVDIEMg8fw

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2