Extracted

• • Target

    JaffaCakes118_85ef810dd3d85f2a30e50d652aca8dd3e85933eaccfd3efa735bae6e26fff895

  • Size

    220KB

  • MD5

    472f3c93a3a556b6d411fc8545f499a2

  • SHA1

    0b3c535e3a9eb288cc6d1f288b81b10528e62515

  • SHA256

    85ef810dd3d85f2a30e50d652aca8dd3e85933eaccfd3efa735bae6e26fff895

  • SHA512

    7aaf7f56bb3d9f177f01d83662ddc915405c175403466fe854d6cbc81f825f9a26c724d07f308f6ae2f288bd75840024a8065306167c1d178ba8edb3e96809df

  • SSDEEP

    3072:jQ2Bp+bjYIVbAEz26obfSW2HDy5LZUJ98Wrxpzbgqru+sxkgaBChaz1Y:sQ+PYMby7S/Qq6uzbgwu7igaT

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2