Extracted

• • Target

    JaffaCakes118_cd23cbd1e13b53d1932af8dbd1a93718edb9efaf6fde950c1fe380764f464559

  • Size

    136KB

  • MD5

    9b65a7119b0bca572ee813bf80b152ef

  • SHA1

    34f024ed899317f7b46d61e186d9ad4be7d0e813

  • SHA256

    cd23cbd1e13b53d1932af8dbd1a93718edb9efaf6fde950c1fe380764f464559

  • SHA512

    44a87588436df80884c5ddb95b762febe66ded454ce2310d1bfb249ba89d79014dd39b89ed1eb0d9d7e8be8cc1ffa655ee60eb74e7f2a3f4df9abb408bf6f3af

  • SSDEEP

    1536:TL0xHUcaPRbcisykYAoVIdZaR7ykf0TSRpoF2I6NHujdKAJGWa0XZ6E/9nD5zB/J:naiIiJAYPf06NO/JPa0p64JD5zJoYQ

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2