Extracted

• • Target

    JaffaCakes118_fd216da6145a26e20993ff3eb13cd76ede17cb1f6919bfad9054369c528c23c0

  • Size

    344KB

  • MD5

    e4022343f6c7ef942cc533df3e78d5ed

  • SHA1

    b8983551fe88d4cba4bf7e0dc9f83714a5fc0a47

  • SHA256

    fd216da6145a26e20993ff3eb13cd76ede17cb1f6919bfad9054369c528c23c0

  • SHA512

    80ba74761c5b39471e558cdd9f7cf6ce8ad98f62d0b4518d5d49c145dfd7ae1b0409ab43e861ee8ae976bdc4f74d8f2edaaf80a02c6cf24dd0444d7f00044e02

  • SSDEEP

    6144:Ymm51OozxJmVvxcJbWQ1Jr9slONxR/iQNAyukonIYq:GjJmtq1WQ1JrCMZ/iQeZPp

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2