Extracted

• • Target

    JaffaCakes118_ffe28723faf38f895cca323c218bb4a5d3c05b9a08634c366082e6d87645cf85

  • Size

    229KB

  • MD5

    3cceaf2a10d926f108af3e93e95b8b04

  • SHA1

    272ff77b5510a9cd682f02fc7f6b823bfec081fc

  • SHA256

    ffe28723faf38f895cca323c218bb4a5d3c05b9a08634c366082e6d87645cf85

  • SHA512

    06e6ce07d60ad94fd7d58ff3367ae684e5c5e483c1f65f2c1fdc900f93d62f33b84efe0d117919befa1044256ef2587253543282ed14464c69c001fa96395b85

  • SSDEEP

    3072:9F579c+MXLfd78Xr6yVAhikTUZTO0SXM7yn171sUSizP0aRHJDMV3zrulYn05Fmu:9F55c3V78XrfALTURgPSizca1JsId

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2