Extracted

• • Target

    JaffaCakes118_b6ae7251deb7aa169a16112515e94ac61942559ceeb2451c7c9c743214fef37e

  • Size

    246KB

  • MD5

    3ad9b12cbfa962da1d348b26cedb62be

  • SHA1

    3d0044c9f144ce76e2301c0c3a6ae2bd391de740

  • SHA256

    b6ae7251deb7aa169a16112515e94ac61942559ceeb2451c7c9c743214fef37e

  • SHA512

    1cd52b441343c71f6638dcacd2731ed415b53a271b2c064e3ea769ebdee371f52793d35bf75a77e093107b48ed1d71c6570010f25f7d4cefc4d39ffdc3b11b71

  • SSDEEP

    3072:g7Jxh2xryErd36x5I2b2VpN7O+NIjzit/WrxpzbgqruXhs7sxkgaBChU/pZa9uDB:+2xmE56x5IXmiRuzbgwu6QigabwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2