Extracted

• • Target

    JaffaCakes118_e717b1c7b77d59586e67ced2da5e4e42280f97e1a6abd3f12dc9c671fb14b41e

  • Size

    285KB

  • MD5

    5b466970f8e25d73b937aa1578dd44ba

  • SHA1

    9bb38b02e5e6b1e0352408357ffcad753c339f12

  • SHA256

    e717b1c7b77d59586e67ced2da5e4e42280f97e1a6abd3f12dc9c671fb14b41e

  • SHA512

    536554bb9ddaa3a9ea1d5b50726efc60fd72008868716b376dc6eef3049df76e02b3cff7e52621db6d247e7e7a56f05d71515d07dfa182071e6d137b822f289b

  • SSDEEP

    6144:SKOnV2tU9Xp8YYQTPoSEHnwuzbgwu6L7ITsqSigaTwVf:unVpiYvTPyHwunnn7s

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2