Extracted

• • Target

    JaffaCakes118_a8169b1cab58e46a0c1b4627474f2d9cf23b7050a5d3ac2b8704e619b67835fc

  • Size

    161KB

  • MD5

    57369a2964bae1145d8e60e93cb03a09

  • SHA1

    136acbf24badc0f85b19d262349a062d517a30d6

  • SHA256

    a8169b1cab58e46a0c1b4627474f2d9cf23b7050a5d3ac2b8704e619b67835fc

  • SHA512

    64e3bf8c255f959f7460a69f23372f5d37f4d8e31f5a097e58a11e415785cbaba97587d405b4ecd21c3b6dab88617f84b20ca2788c3dd6ca4bd15acaf7a8fd9a

  • SSDEEP

    3072:4lNGUja6WGK67WLy7jMx5UI+lMMVUB6shv1sH:MGUdWGK6S7UkMVUB3

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2