Extracted

• • Target

    JaffaCakes118_f97e9234998e7353bdc892de79a4417d3b71cc6ecfd9ae93c126548d248cea8d

  • Size

    179KB

  • MD5

    3ccebd9ecee533a6da8d05648531fc2d

  • SHA1

    6fffad579f3553b660bdf44f3fa20ada8459ac7b

  • SHA256

    f97e9234998e7353bdc892de79a4417d3b71cc6ecfd9ae93c126548d248cea8d

  • SHA512

    bc259f01185020dab056cdcc0655a46f6a189238efc9b9e1a43fa016554d37f8941e94a5f661e42df41388e3f65c917e35a9418911e705c938f1411d6ff31f8c

  • SSDEEP

    3072:87S4EKeM3KP5f6VXjth8p8Zc7XNhfKgqr8XscnUiDJ5:yeM3KPlKD8p8Wnfacnl

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2