Extracted

• • Target

    JaffaCakes118_59376aedb4b6ed98c11e98f46edff7c62e159a6d4d63ed2eaaa46805006b0085

  • Size

    343KB

  • MD5

    8bac9589ab10735825e69f14afe283b4

  • SHA1

    d7e4c66cd54b61258a08b3ef44f6c6919b3b51e4

  • SHA256

    59376aedb4b6ed98c11e98f46edff7c62e159a6d4d63ed2eaaa46805006b0085

  • SHA512

    c48d4a9dc8387a1a81c77095f060c874a3c0860d4070769ccbf3fd92b9d43310a6dc62b17f7f6f30cfc61b1e7baed3b465f9eecdf8d0d2aca9a5420cbba42dc5

  • SSDEEP

    3072:vPW6RBNZQyyT0TXOtpkAx1O/kCcNVPImEWOrle9rcQLRDLspSiyl2kBxLWhW/9X6:3DUEk/OqIQOrletcQVH2kDaQ/9O3tHt

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2