Extracted

• • Target

    JaffaCakes118_ed3974b35c98e3801bcb42b98d9e9f3ec4b41b280fa07df3527f22ce5adf2e81

  • Size

    209KB

  • MD5

    e82c12ac55c0311711662933ac992adb

  • SHA1

    def513d7900933a49e29246ad3c3477090d57c25

  • SHA256

    ed3974b35c98e3801bcb42b98d9e9f3ec4b41b280fa07df3527f22ce5adf2e81

  • SHA512

    84d22716e46f571c29de52b536423fd5e6ddc6b4302fa8dfb1a151e20022e3a912bd6f924d70f4b9242cf5bd63e79652cb839b7cd71357c37f4b0391063bad95

  • SSDEEP

    6144:h8efQLO1hTJO9iaQF/SE+Zdq5bdb7ITsq4:h8eIQhTk9TQxfcdgbh7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2