Extracted

• • Target

    JaffaCakes118_3004638c8e9c7e9590c0c1b1286abfbd13f773a195e8a850343e6628be166afa

  • Size

    177KB

  • MD5

    a3aabdff3b4a3399c1829aee537c0beb

  • SHA1

    10eecc1051a96d49e0de197cd18d50f96e3ea8cb

  • SHA256

    3004638c8e9c7e9590c0c1b1286abfbd13f773a195e8a850343e6628be166afa

  • SHA512

    fcf179521467be64b64a8a6e5cf709c4e27edcc0e7cc6400e94d6e0feaef0a85c3913767462bfce12ecf4ab52539de41550e6d7558974a021011c658a6547cbb

  • SSDEEP

    3072:o7Gc4zi7lBoiYCKegOfPS1ece1WHY2IDoN44oa+EAF:1zi7lBoFXVcPS1ecn42TN4ra+EAF

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2