Extracted

• • Target

    JaffaCakes118_a3adb0166f99e3d6632f0c915e9bf9361223b42639703f13873d9a1934e6797c

  • Size

    237KB

  • MD5

    1191183d3c4cca2e9799d6a6d1c67b18

  • SHA1

    6924ade5ffeef5b226223b83820e0e7c962a6102

  • SHA256

    a3adb0166f99e3d6632f0c915e9bf9361223b42639703f13873d9a1934e6797c

  • SHA512

    7dcf7b30bb597917996ae1b22125df13127ee0a67242440c4b1ca3d7eb3f14f7435d180b1141d7c0cdee6e50891398ccac2a05c7953b372173b20bd66b282353

  • SSDEEP

    6144:64Mm3W6nJ+lQ/7O3gLtA3wdZwwisdBLyJFJN5P0:6dbYJ+lQMgLtAgtiMxyJFJNN0

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2