Extracted

• • Target

    JaffaCakes118_dc177df1ffea1b1ae45b27e51a3ac3ff6218c1b6590ad316b5703196c2969925

  • Size

    159KB

  • MD5

    7660635a50899e71c211b7d323c221ea

  • SHA1

    b4421fb519fadefa1a2ee4924b55bdce80c027a8

  • SHA256

    dc177df1ffea1b1ae45b27e51a3ac3ff6218c1b6590ad316b5703196c2969925

  • SHA512

    8065a7d7a36c63ccd4f3b70c49cc2c651425d061e541c88e2b8576c5dadca3b94fdaa025abc960b1021aa3d08da0bbcf2ef6599225cd60b5507cad236b151159

  • SSDEEP

    3072:/76t3I5NU6gM6ueKflIMykzYWzJn3iIsNb:OI5NUVdsfjRYuJ1s

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2