Extracted

• • Target

    JaffaCakes118_d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

  • Size

    219KB

  • MD5

    48db79b89beb4b17fabcbb7d8704873a

  • SHA1

    fd47d711e03b703937341a5ede33810601900963

  • SHA256

    d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

  • SHA512

    2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

  • SSDEEP

    3072:uUlCE+24yoqJOes39Snq7Mhy/oJlpWrxpzbgqru+sxkgaBChp9EuI:XV+TyoqIehgMewnuzbgwu7iga+E

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2