Extracted

• • Target

    JaffaCakes118_b53cde44f664b97dcdeb95e795a503bf1ea0459aec569e7fd720eae00465df00

  • Size

    146KB

  • MD5

    35d2e76123aacdc2f711476cdf0fafc0

  • SHA1

    9836b00a794764404d6b67d31f0108cb32bdd6ec

  • SHA256

    b53cde44f664b97dcdeb95e795a503bf1ea0459aec569e7fd720eae00465df00

  • SHA512

    bcd513d186e8af75eeb350d62c2560efd59cc23018761936b2605f83921f39bac32cb5c052e380448eb35c372bd0f931a0338f1bef3ecbb93c2a0eba61ad290f

  • SSDEEP

    1536:yfISSdp/jPWfoqVxFY7VY0e4ahObF8OXkZh3uJp+Q7Jgz70J62CAWhJz:yFYpafoqZaLFLXkTqfPM2CA8Jz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2