Extracted

• • Target

    JaffaCakes118_70c568476aba5ca1e604d7db73d171be61a8df792fd798a76a14c8d9e510a248

  • Size

    138KB

  • MD5

    26b7ae3bc5b08c57a8fabd30e42e2d56

  • SHA1

    23821aa60da21917095f294c5315f3ef7c4a3a19

  • SHA256

    70c568476aba5ca1e604d7db73d171be61a8df792fd798a76a14c8d9e510a248

  • SHA512

    9e890c9476feca005bc41fa84c50533a2a7af2ccef3f1a1e394b26cd02c009450a2139db3d829fa1f338f2f882d53ac1a24ff6575c5296fb1611ca3bae4e930d

  • SSDEEP

    1536:oskF/KbaP0eEGzXLRfduoenpLbrtl2fx85W+esR55ZRjlcs9jU+x0n:3kseEGrFQnxb6f7FS55HjGs9j4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2