Extracted

• • Target

    JaffaCakes118_ea371cd3d1ac8c8787e90acfa0c4022e6b770fcbc5dc996ea95e4af15ed8e46a

  • Size

    153KB

  • MD5

    b1206e4d87af6babdbe3b4ca43a9bcad

  • SHA1

    8be00ab261754a95589aa67ed147ff169ef124d0

  • SHA256

    ea371cd3d1ac8c8787e90acfa0c4022e6b770fcbc5dc996ea95e4af15ed8e46a

  • SHA512

    6a4ae0319e3a83b679e81e9496ec365d14fe0c4dd91eefb6dcea3e5fec8151ea67761e32ee24bc5710121f021f73062bab3a7dd2806c789ad2d7724c9fb34b08

  • SSDEEP

    3072:I1R6lAXozVklu0SzKei5pgE+BHMZu0Oyz:I762XCVKSHV8Oc

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2