Extracted

• • Target

    JaffaCakes118_9463797712a33f68379cc2ab3f503a6ddc1b3abcc73d2cae21d9889118948122

  • Size

    260KB

  • MD5

    09662c2592b14405b5c16b764060d751

  • SHA1

    4c6e859253fbd8093f2200b7bdaebc27f19449d8

  • SHA256

    9463797712a33f68379cc2ab3f503a6ddc1b3abcc73d2cae21d9889118948122

  • SHA512

    73427221b5bd5d2e260bfddd1664e5fa0ec13e781cfaa6e7598e8a453e7b9e39908b0cd409ce551cd744cf9b602edda34293799c38c3122be155bd38ab002ac3

  • SSDEEP

    6144:2QXRZhTGxVInBgovdk+pXFE/WWWLNarbRi7:2KDhGxVIBggNp1EYBarbRi

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2