Extracted

• • Target

    JaffaCakes118_2041c358dd60883a38ef86aca2312d60b212224630afd4f71f0912fdd9509321

  • Size

    277KB

  • MD5

    2f1636d08eadd59792ff590f7752059c

  • SHA1

    0ba20ef238027d1fb320df79746f5453b1cf3892

  • SHA256

    2041c358dd60883a38ef86aca2312d60b212224630afd4f71f0912fdd9509321

  • SHA512

    0ce40c8db3321bae1fdd882d315a2b146a3388cdfd7381437a827cd02980282e04f001e1c25120305d16300da111133ebdd588dd2b2b2f716c98e4973459a250

  • SSDEEP

    6144:ExmFJ/CjeWZ9qpvqTeU/BmZ9QL47avLE:9f/iHqdqTeaqiL47ag

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2