Extracted

• • Target

    JaffaCakes118_a8fbca1fa917a16435b65abf5e83d85dcd4514f401ca4b635691f95d44834232

  • Size

    169KB

  • MD5

    54bd5f89f412ae17884504b9a86c5e63

  • SHA1

    8c596d102e6836e640a083ed4f9e9d127f919749

  • SHA256

    a8fbca1fa917a16435b65abf5e83d85dcd4514f401ca4b635691f95d44834232

  • SHA512

    66342f222dc8739599c51d0f46e0c71dc2649734717c33dc940a56fb080508c30f64f289f414c2c37a0c807fb4e5cb2761ca6e41b2b372fbd139b90a089535ce

  • SSDEEP

    3072:g5FWLk1FgKtHVuVtDcfLHQT0WXFl5TSQtXV7YZScM+kYBUS92:EMg1FgKRVu3DcTHQTvDTtxYgzMy

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2