Extracted

• • Target

    JaffaCakes118_bed95c3c7b9d573d93e2de96c4543078346e7ec0ed38022b72d2be9588792f6b

  • Size

    270KB

  • MD5

    65b27135bb9e44c1ea0e921b22370b4e

  • SHA1

    325060bd1ece1f550e7309b1bd34547101c6fd6a

  • SHA256

    bed95c3c7b9d573d93e2de96c4543078346e7ec0ed38022b72d2be9588792f6b

  • SHA512

    dbc5a27b1838f7d2bf76f2f20f02f3a717b6b51c6fc58ca58686e6fdd3422528e2b1471c68c472561783987678e2e2994c49a01748d03151793ac16f963df4cb

  • SSDEEP

    6144:esrDGeKy2Q9ggLseGgCy9MoZ+QVqQmXdIU11:h+y2Q9ggLavy+oZLnE+y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2