Extracted

• • Target

    JaffaCakes118_ff133f96c330a714e7fa30fa0744529db63e650fe9bad172f6d3e032ec2121c2

  • Size

    138KB

  • MD5

    223b4026fb997a4de0d42991a3629e85

  • SHA1

    0d03685aeae7b4e49068e3e84bc154be5fc1f8b6

  • SHA256

    ff133f96c330a714e7fa30fa0744529db63e650fe9bad172f6d3e032ec2121c2

  • SHA512

    28b9e376420562d2354b995d834cf25611c787aceaea0ec22a6f736ee6fe54717e98bfb031012130f254d0d599fc134c48eba824d42ef02ca6c51a97a0812429

  • SSDEEP

    1536:QtZPAC2DLRaPLmePIWdy38y9Pk9HDQ21XNk+fMk5NjIOhY0U+j0n:XumeAD8vjnZPMk5mj0e

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2