Extracted

• • Target

    JaffaCakes118_21fa4d730a137bc1b96e8cb8a175e737e7d6ff3ab3eb2b068f9a3437508aed1d

  • Size

    289KB

  • MD5

    fc3b7de2e1349e3132fbbc37ff6c265d

  • SHA1

    acd8bb57f4297c422a531a13172ae0a89637d4ec

  • SHA256

    21fa4d730a137bc1b96e8cb8a175e737e7d6ff3ab3eb2b068f9a3437508aed1d

  • SHA512

    95c7c767abc7383c67fdb6c84a05c5b6baabe74f71c13c1cd0b4c11bf62c6157fdff1a3867d49162d89ef6a30c20dae1b76781ba2897ccf2f93a1a70ecd16422

  • SSDEEP

    6144:eRpABz+P8behNzsXqJL6F6EkOOhxxdeTr/ekI:DBz+U0xL6Fdizxd6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2