Extracted

• • Target

    JaffaCakes118_8ae9b2067746677ec60b3895b7e5b4a6819f0e51080ce320b017af2dd037cea9

  • Size

    228KB

  • MD5

    0a17fcdde1f0e57409464572f985e475

  • SHA1

    2db334310c654e9718285a77b2eefb8d322cf57b

  • SHA256

    8ae9b2067746677ec60b3895b7e5b4a6819f0e51080ce320b017af2dd037cea9

  • SHA512

    7781c450c1070fdb8084bf816a7f6f17e9ee117ae6c3d677509f6e4a7ea32c3578053f165b35b7c01900278279d8551a4a3ca4559c389036cefc3fa968c2b59d

  • SSDEEP

    3072:PFSW5Ha6XLb/ts7j6yVehikJwu9nO0SXL7yl17EgTMfulAS/o27Lo4rDgJQ:PFSeH9jts7jfeLJwut5DblSogq

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2