Extracted

• • Target

    JaffaCakes118_71aac11a291af42dfe2de42ae6523b9c1c8a08d1335d4e41ff37a8c2a3f5a020

  • Size

    238KB

  • MD5

    7ac48fea930450a7921154d8fce9af73

  • SHA1

    7d5d237614902b12e9284a268cfec555ddce2c91

  • SHA256

    71aac11a291af42dfe2de42ae6523b9c1c8a08d1335d4e41ff37a8c2a3f5a020

  • SHA512

    2aeba3519f28465b0b771e60f8dd786d37fb556810d92f0a15f38990aa597d24d7b93a0ad87e6cb700a84f2d587e369f94d016b788d570ee689ffce2ae4bca50

  • SSDEEP

    6144:9X2ED6j2XfHNWY2CAhgfzoup0x17ITsq7igavwVf:9X246iXQzbGfcupk79

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2