Extracted

• • Target

    JaffaCakes118_b2d49955cd044928d499e29bb44d312e307c40c0d6915827b7adb5f1a6baf24a

  • Size

    187KB

  • MD5

    be6f567dda80049643af2663e424738a

  • SHA1

    9edb7aadb0c618f47a9a41ea08fc3e84be85969b

  • SHA256

    b2d49955cd044928d499e29bb44d312e307c40c0d6915827b7adb5f1a6baf24a

  • SHA512

    67ab92315ef0aae0903027c272c5c50418a15cd747de49a599444120ad86366ba4e870098a4d1a1f35f41b9a7897f3d6986ae85e965eb0d3514fc71dd58b740c

  • SSDEEP

    3072:j7GjEiHnGPtAA/7Lc5nXn7I9bfBopMTcDcCgjopZa9uD6Vdyhkp:oEiHnGPTzLcVOBgKVcwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2