Extracted

• • Target

    JaffaCakes118_8745eebbbf3398803f2d705627196b59071b4d327af4c98d461983d5427e6a7e

  • Size

    159KB

  • MD5

    60581cefc3ebdcfba7ab65039c713789

  • SHA1

    579d83b65618226c00de84c4b767369cc80db1e8

  • SHA256

    8745eebbbf3398803f2d705627196b59071b4d327af4c98d461983d5427e6a7e

  • SHA512

    a4756078c21afaf68e836bc66b21889ecf6c19530e16e14fd919cef3e550075ad34e5a8f43b306a351c79d97ce7fc9e5a47d38b3f488cf7298124ac940634e1f

  • SSDEEP

    3072:Z47FGXpybBYZZhvV97DxqSeFdywcIWnv3/35ugf8FtKZ7Ev2:ZHpybBYZZhb7dqSqdNBWn3p84m

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2