Extracted

• • Target

    JaffaCakes118_76e5de1e9ebafc1cd7480d3b6223e62cfe2e98a7e6a4afcd463af0f2b219c239

  • Size

    159KB

  • MD5

    34f90b79823c2119291242a85372614c

  • SHA1

    a0a1e2ca7601fffa34ba6d0c9fe81214c7fd60f3

  • SHA256

    76e5de1e9ebafc1cd7480d3b6223e62cfe2e98a7e6a4afcd463af0f2b219c239

  • SHA512

    1047e34b82be935e77079aae9c761c78c9de56ba1003c4c9e891863dd3cc920bd67df5ab4df65f785b21644a493d260524f2557e9554094401b8cc8c8f786c5d

  • SSDEEP

    3072:f754OjNeZE6gjfPa2CAbQSi2sjnh3NnTNJSLZcY4N5FokL:FNeZE6gLJC+l32Nn1

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2