Extracted

• • Target

    JaffaCakes118_dd9c4385fc60b66787f053905a3b64f0aea756f985cfcea9fe1b8d44ded821e6

  • Size

    316KB

  • MD5

    6e429866ebb90b7584e2ff0b07e20940

  • SHA1

    4f6f8aca65c4a1276424ff4689c67ded7df61da1

  • SHA256

    dd9c4385fc60b66787f053905a3b64f0aea756f985cfcea9fe1b8d44ded821e6

  • SHA512

    8b8cd1beda47812676b7288e254183b8084c7d4bcb02ad149a7c5ed763898b25b81e94a27f6d9b2cb9caed745ebd2bb1608ddcdf4aec8f669898f71364e9b35d

  • SSDEEP

    6144:0PCx2eJABZX5sTWQ3J+fX/8wOeIIDLY493GLMLI2fsS:oCx2W+X5sTWQ5+fX/8wOeIIDLY495LI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2