Extracted

• • Target

    JaffaCakes118_a28d43022796b67f3436e736c9b4539640cb57673304c77f93f53d73e2edd3ee

  • Size

    234KB

  • MD5

    ed700237ae98c75e0552077ff9a4e162

  • SHA1

    828692ee6880cd1f18da0f4c58566d6e5e8d6f92

  • SHA256

    a28d43022796b67f3436e736c9b4539640cb57673304c77f93f53d73e2edd3ee

  • SHA512

    e9ba4cf57563aafd1531b9a75f1d83b8e2f307ecef83e60e2467bd45482718581b96f7c792680e643e2d1587f2ce06b4476ed54502ba0cefded9237d0743bcc6

  • SSDEEP

    6144:Ho9cm6juiXkrg3mtJ9fE53Z2fnpEfdmS:Hicm6juiUg3m5A34ald

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2