Extracted

• • Target

    JaffaCakes118_7aaa8b1ca724ea23bcaf68edcc1227e9f2215eecb62e910ef2b73f282cff6e62

  • Size

    290KB

  • MD5

    d0935b18c8c4e688770bedde80cc75e3

  • SHA1

    aa5c44e9f1a4c2169a67eb6a7919ab3daf4bd022

  • SHA256

    7aaa8b1ca724ea23bcaf68edcc1227e9f2215eecb62e910ef2b73f282cff6e62

  • SHA512

    40fb545ffd988f448e08bd67046b98cc8c420af2ddc5a8fa6a90653583cf48d46849f06b83fcf60941bc2f425622f34af6f04b9a29e6cf96d827a3520fed9fe0

  • SSDEEP

    6144:E4/bmgFd/VXDta0m+6SXuZet0ySbTHgV51pstmNaj:HzVBa0x6SXuZet0ySbTY1psK

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2