Extracted

• • Target

    JaffaCakes118_f6089f378dcc826700f20097cb4f1a00fb4d22c9fe40869b7aede2f29d3e4cdc

  • Size

    284KB

  • MD5

    ca7aeb5a60acae0c31c9b4ffc9cf6f60

  • SHA1

    93fcd9eecf5084833b2cdbedd02af968e0575e11

  • SHA256

    f6089f378dcc826700f20097cb4f1a00fb4d22c9fe40869b7aede2f29d3e4cdc

  • SHA512

    4199d53ab4af5f821c11052647d821989f1f1c8b496ef45bc5cbbd4b8cfdd181749dc9b5d117ef3903c519717fdeb8a4d6cbe4fbc02c36a28313c6168a1f3e61

  • SSDEEP

    6144:DTvrK2Wzs8ivE1bJ0PcmeovHM9c+S7pZt:HjK28OvSN0Pcmeooc+Sh

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2