Extracted

• • Target

    JaffaCakes118_c64e2ef9ab2c17bff92fab62479fbf3ce1724c4e8f5f9a2bd9f4c40113f433a8

  • Size

    325KB

  • MD5

    424b5c8d8ecadd9049cefd26188984f7

  • SHA1

    b257341ca384e216ce6f286184606bb431d14217

  • SHA256

    c64e2ef9ab2c17bff92fab62479fbf3ce1724c4e8f5f9a2bd9f4c40113f433a8

  • SHA512

    4334351e2f789d41763481e0e851175be92ee275faca9af5e33592d9e054dbcbd8e3deeacb2f5000872971e2cad4d19e1763360a47025c7f5626528a273993ae

  • SSDEEP

    6144:erHiD3oQZ2HobNAJIZMVfwoYFWwGGeolAHPs53HpZg9qR:+CD3F4OWwGGeolAk53f

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2