Extracted

• • Target

    JaffaCakes118_090d1c667392de95141f6de35994eafe1b37e4e7bdca53d771fd0daf835fed24

  • Size

    147KB

  • MD5

    1396631f611f0b34bfa14e49f3774c72

  • SHA1

    cd9a713144a06aae7b0050b6bf63362035fcd763

  • SHA256

    090d1c667392de95141f6de35994eafe1b37e4e7bdca53d771fd0daf835fed24

  • SHA512

    130961929d17400c5e9c2d26b6052847506c634460284dd29456c150c90df9d186edca1988fc9bd7fdfc8c8265a233b2fed65be9816c18b8f52e56a45fea348c

  • SSDEEP

    1536:MfISSdp/jPGOEuP7Wvo1xhY15T+ijyP5+WiTHzf0cGNIk6h3uJp+Q7Jgz70Of+RR:MFYpxPkoBSVj+5IXf0cYIkwqfPLRJDz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2