Extracted

• • Target

    JaffaCakes118_d9d85ca93b32fa124f373a5c3cdb9afecd62769badd6bf3e87f32435cf6fd917

  • Size

    188KB

  • MD5

    1f855ad0630354c9b8e575d15d289fad

  • SHA1

    6baaa9ce196472a74463d7dbe2a05a4433c81146

  • SHA256

    d9d85ca93b32fa124f373a5c3cdb9afecd62769badd6bf3e87f32435cf6fd917

  • SHA512

    d2b3068c3f75897dd4952b8ea6634c0079f298c3dd93f4a0e539603314e089bd12c7ef8f93308c53031c3352afdbb91cc2ad7508672b23701262a3f6ad4ddaf6

  • SSDEEP

    3072:xE7PxL7B9burFSv5ucLkCI6Hyxo1+d9RDpZa9uD6Vdyhkx:x0L7BRc65JYCdyNDwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2