Extracted

• • Target

    JaffaCakes118_e3692685f9a728e0daeea23f159484fd1009bf615126d51a29440dcf53ab0d42

  • Size

    184KB

  • MD5

    31fc0122636001e76cca65cd85d28a7f

  • SHA1

    9e42a8fb0214134f7312068cbfa4a1f663b629c2

  • SHA256

    e3692685f9a728e0daeea23f159484fd1009bf615126d51a29440dcf53ab0d42

  • SHA512

    5e0527691f54fc26e683fcf692d637678bc57aece088502ce24d2f3430eb908c50f36c99f8f423eaadbbd574ee1a4b6e7e157ebe346160adba6c2237094e9314

  • SSDEEP

    3072:nkmEokfyW/Sshyd6OCbefqGKIti4KrTWssUPZPwTns9MUjYAYeL9hgC:n8okaW/SshhQijKiZrT3jPCUjmev

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2