Extracted

• • Target

    JaffaCakes118_641305c8da92fc65607cb1fa662e20e76051d4e5718b951dac76fe9f1952fd64

  • Size

    327KB

  • MD5

    183b564ef508bf5b3575f43329997ce9

  • SHA1

    5d0daf1744b511f140f8f90c7b60703f4e8ed8e2

  • SHA256

    641305c8da92fc65607cb1fa662e20e76051d4e5718b951dac76fe9f1952fd64

  • SHA512

    4a181d1b55956cf24330b634481e15cdff6c9257ca977c2ee98cb1c47dad2f8e9eed7f1dcac7a97bc321a3fdc0cdefacccffc590588516bdc681444da4e58c9c

  • SSDEEP

    6144:wA6pBYkTkm2Uaq3eA+OuVRok7hjl1vcOa0:GpRTkmBaSeA+poyp7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2