Extracted

• • Target

    JaffaCakes118_aea58b6cb75a81c29db530feb8f1bbf0f15c7727ee0264877bc6fc80b5fc8b65

  • Size

    177KB

  • MD5

    54f2cea10632e47ab38d113d587ce32c

  • SHA1

    f3f5d9d585045d0c51ac741605a3ae990719db02

  • SHA256

    aea58b6cb75a81c29db530feb8f1bbf0f15c7727ee0264877bc6fc80b5fc8b65

  • SHA512

    e460a1aa990ee7fb908c9b44a79dc648e7f9a58362e45a05a592642026452aa8790993d782a41f97c8757aba05a611cbf6fd2ddebc41f9501e0198c2c4e05fac

  • SSDEEP

    3072:F7ea06Z4EKxA+xZGkXL09dtE03aotb1dSVcsV93:66CEKxA+y9dtE27gV93

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2