Extracted

• • Target

    JaffaCakes118_5f1de5ad55c9145f7d703b693ce532efad766fd47cbc10b87562d815c059ae33

  • Size

    284KB

  • MD5

    0b19b04338ddda5554112c86c5791684

  • SHA1

    93cdd5161cb58122fc0edfe66a7af5b75a89ff4c

  • SHA256

    5f1de5ad55c9145f7d703b693ce532efad766fd47cbc10b87562d815c059ae33

  • SHA512

    39fb27528029cd6664bd503625ef13f116dfea6353271bfebf74f69586e844153c0d8e8452acbf481b450fa511bd8a0ce4ed2f9995b40f57374394159879b6eb

  • SSDEEP

    6144:uT5AEWRLSnPVskaD/gi4T9HROhxxpeTr/ekI:ulAvGnPSdDnzxp6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2