Extracted

• • Target

    JaffaCakes118_8d929bdd859421d37d3432ef6efb36981c07ccd591a61633e58ec4b4df58e036

  • Size

    160KB

  • MD5

    ea477d707b195f0b44ccad65d77c5134

  • SHA1

    a941fe2f82ac951a69d86f2214208ae1dd9dcd01

  • SHA256

    8d929bdd859421d37d3432ef6efb36981c07ccd591a61633e58ec4b4df58e036

  • SHA512

    65d4e367ceba707dea1d3572862c35a4371035c3f233041561d0111d3e2fb2ba9ac780a178f0b1135fee9fd2089974f6c6f27cd2439f7722d92911bb44b83a91

  • SSDEEP

    1536:ma2VSyQsJgXWheKALv54FZ9YsnVGMk8L7w8ddqOY9jV2cYdOd/5fOJqrtUrfFhl0:xlNGUja6Md5Jle/5mQrtIFs1h/

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2