Extracted

• • Target

    JaffaCakes118_5a3a8646e50046d8f4c0ccb2a9619a89d6f0106820b809e458ea48c16b6048b4

  • Size

    164KB

  • MD5

    55589556956e20067beacfc7f91f1214

  • SHA1

    fdc38166363828321c4385dba80eeb0464f57618

  • SHA256

    5a3a8646e50046d8f4c0ccb2a9619a89d6f0106820b809e458ea48c16b6048b4

  • SHA512

    8012acbb678ff4ed847e3729f286c1ee82b978a7765ddcfad7370b22909620bb6bfd93770aeba24787a125d559f12e02c95494fed7158473cb57aca50d305107

  • SSDEEP

    3072:b1u4aoikSqnB8VsNbIvuPypJB5LViiP0aGCyS9H6l:bA4ViK8iWvuPbJEa

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2