Extracted

• • Target

    JaffaCakes118_c7fc4a06e62713e2e317edb8d4d7a16deab408763d8d2b9eb07cb00dfe4e5391

  • Size

    165KB

  • MD5

    d5a681d05ff818203baa6089fd07136e

  • SHA1

    ce8e81746a32507d44050cfaa65ed9740c81acdc

  • SHA256

    c7fc4a06e62713e2e317edb8d4d7a16deab408763d8d2b9eb07cb00dfe4e5391

  • SHA512

    b84c65ec603656e5a369dc6129024e0436642c0f0837a4de665ed838bdbe5a8eab94b656edbd7bfcb177ba768b29c9fa2db91f6b6b3a613ac86694127759f076

  • SSDEEP

    3072:iuerXeNjwshS8o15iZ9/D+3pCTMfsHY87+e2:SrXOjwshStiZo3Eas487+R

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2