Extracted

• • Target

    JaffaCakes118_7297e37f154cbba0033e436607249b89d8cf3ed1782232754723f91bcf390b75

  • Size

    284KB

  • MD5

    8ad22c2fc953146a7ebfbd4e7b92e8dc

  • SHA1

    19f1b548b0c073387cce1e2aa4b27e1b20f41b12

  • SHA256

    7297e37f154cbba0033e436607249b89d8cf3ed1782232754723f91bcf390b75

  • SHA512

    1ee75b4fa9c89f94783fb65eeb8a88ba6a62d5543933e1b996bab8d050961fc3d135e9044d17680b9bd381ea2ad0b4ec0f3834d1014c16e46b0d1920dc377d75

  • SSDEEP

    6144:mo7WDeIh7kIMrEpz5kgQYwwr6dYHhSXuZet0yS8/YBtrG2i15ioo9vPDiT:MbiISEnZQYw46dYHhSXuZet0yS8/iGFv

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2