Extracted

• • Target

    JaffaCakes118_274b3c536ebcb446ca777abe139dba4b712d9b334e15608a5c3331deec2935e3

  • Size

    317KB

  • MD5

    0e2a6c2b461933c7a1e7a048ee1f5b25

  • SHA1

    a8fede94148338f469399d62fe5f72aad45f8699

  • SHA256

    274b3c536ebcb446ca777abe139dba4b712d9b334e15608a5c3331deec2935e3

  • SHA512

    95f3bdd286a185e3cd2c3e7b5bec5f53cfbf262254618527f8a183ac1055a581b1dc612b0464da76de3241abd8ca68d6f0779a59a9c06a6db37fb1a64bbc76ad

  • SSDEEP

    6144:jOTe/jixL46Z2Lbf/j9A1wn5qJL6d54POOhxxdeTr/ekI:jyc6Z2LjjCL6dIzxd6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2