Extracted

• • Target

    JaffaCakes118_753ec892deb630e1b540058617837fdfaeabdae4078bc0917c055a805d4752e7

  • Size

    279KB

  • MD5

    295cc2519a6559471017d7cfa7963906

  • SHA1

    48d5984d57e5efa254fe2557488274f3845874bf

  • SHA256

    753ec892deb630e1b540058617837fdfaeabdae4078bc0917c055a805d4752e7

  • SHA512

    eeffc54acd8c1a38b8401b111829259de886fcf42da365612453a1b2a14943712a73298663e9d864df2260e805c22bdbcaf05082c1deaec917ea22b1f3d7970d

  • SSDEEP

    6144:2ExHiDcpQKTyzmBosTPI3K3XROhxxpeTr/ekIw:ZHiIpQFmi2Yzxp6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2