Extracted

• • Target

    JaffaCakes118_2563eeeeb403a1d81108b0c58af5d56a6189b14130e81bde97dfc8115c5c04c0

  • Size

    333KB

  • MD5

    0d81591c91af26ef156bb2303634dc1c

  • SHA1

    75fe41b23cd10e46789557d7291bb3d5a41f5d06

  • SHA256

    2563eeeeb403a1d81108b0c58af5d56a6189b14130e81bde97dfc8115c5c04c0

  • SHA512

    0bd8277d5f6d3a348d280122a089cda996936023ff7e9fd849cb684ddd3403c9ed90e6431d15be608207f5f590a49653b350423811d74d98a5aa0d7a6bbcae71

  • SSDEEP

    6144:xo2WWlmy0uqXGcQnZrwdVi0prOJLZZ5e6719ZIe:+2WWlmnRQnZrwdVi0hcLZZxpDIe

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2