Extracted

• • Target

    JaffaCakes118_760dcdefd76a6511354f00a7eaa02830f82f5f9cddb78cc2ddb20dfc3bc3bf0e

  • Size

    160KB

  • MD5

    686fc196e10156d0a866258e20534432

  • SHA1

    295e798b2d891f5a894f29f6ca9af5ef8c81b14a

  • SHA256

    760dcdefd76a6511354f00a7eaa02830f82f5f9cddb78cc2ddb20dfc3bc3bf0e

  • SHA512

    e0726d5adbb41bd7c69b97c2be8e09a867d34e1899ee32bd03e0079ee6c4ab652a6d7bcfd9033204573091e04177ffaee1326ea867718615ff673f1675123ad2

  • SSDEEP

    3072:m+qa3AwxO2IrqgjxT3WF5UvE1WhOgdq8jsYB6Gu:R31O2UqKRWyE1WEiqdo6G

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2