Extracted

• • Target

    JaffaCakes118_3053837114eb098cb0fde68bb99db208eb69035b9af2c133a83971f05bf22e55

  • Size

    154KB

  • MD5

    1417d3bfef9f5d4b068124f9df853f88

  • SHA1

    e82683043a292e42abd968422ada90f2ad3a6a26

  • SHA256

    3053837114eb098cb0fde68bb99db208eb69035b9af2c133a83971f05bf22e55

  • SHA512

    dc47bb34b28bc64be767f2569cb88c8d4401b00fc8eeea0b7cc7b4156c3036484b87f308f447c310d1ac40c711a78d4738f1c1cc4619df196ed9e4cc7f23170d

  • SSDEEP

    1536:93XTaOHdVEPzF68p31lwV95rPFlhyg6yrfAvKm5A5XzcwC1sulQoPt/CD6Hnz:9zamdNYlY5Z7y44Sm5A5X2ODo0OHz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2