Extracted

• • Target

    JaffaCakes118_e6e047c6487cc3f00d59084d38f831ea6ced3be17ec8a7b1932bbda6d07c09ec

  • Size

    234KB

  • MD5

    c0e15986413e5b830d1228f358247bb0

  • SHA1

    9b4bbf48e3cb01e0e69a7f204580a3fa2a391115

  • SHA256

    e6e047c6487cc3f00d59084d38f831ea6ced3be17ec8a7b1932bbda6d07c09ec

  • SHA512

    175aeee3d81d94c2c23f56cf13870090e540038d29aa47b99c0f54e876d9d62bbfd37119ed1deb3776402ed9d24268816013e90d93b52790108f2a4d84014751

  • SSDEEP

    6144:Po+nN6bo6whkr0QGZPGe/O7oli8bbR/HmB:P1nN6bo6wi0QGZj/O1yJs

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2