Extracted

• • Target

    JaffaCakes118_f9b47b661391df7abf158114a2972578611e5b221081404068caa304b933d83b

  • Size

    243KB

  • MD5

    634b022c0ce8ef6d058dd4585135bfd1

  • SHA1

    28ab3d6e6e41d10b881136f4b92a891dac69b761

  • SHA256

    f9b47b661391df7abf158114a2972578611e5b221081404068caa304b933d83b

  • SHA512

    73d7f31c18acbf4fc5ef668254cf3a8c3e4817a31d014a7bbe381ef6931ca85232b0621be2ade16f7e5dd0644559ad094e9e763efe0894e8cbad403c718ffd04

  • SSDEEP

    6144:LBZQuBT3I7M1BFd6F2zkO8mvIhA3ATIXfzX3fc8:NZ73I7WBPzkBcI5MXfzn0

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2