Extracted

• • Target

    JaffaCakes118_852b4503d236e4c9791449bc59dc3e81718c98ce87a9fa2253de95fd362cf033

  • Size

    258KB

  • MD5

    3b7e3f26701a8d911c01b5dd20cbc88d

  • SHA1

    a151397e5e820e637b826cc70f5727a63972770b

  • SHA256

    852b4503d236e4c9791449bc59dc3e81718c98ce87a9fa2253de95fd362cf033

  • SHA512

    f1c0d25ce9a43e0d444712fed708cd0e919c59aa26398976f834a7b19d1257200b23399e20b3c9797234cccd6c2cd0251afa9f14e5a05c7784e8952b21d9e11b

  • SSDEEP

    6144:ZQFMZhT/1A4ToggvrHXgxH8+MKAuERtPQ7:ZAeh/1A4kgi3gdCKA9jI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2