Extracted

• • Target

    JaffaCakes118_8fdfff633ead54bc00629d8fe23693b7d7b6f888a3142351a27d2e8f2720d41b

  • Size

    306KB

  • MD5

    893de434c901ce75a2967c8a55c51754

  • SHA1

    eda71f67e843aac6fa4d9328ad4c75cb7515b91b

  • SHA256

    8fdfff633ead54bc00629d8fe23693b7d7b6f888a3142351a27d2e8f2720d41b

  • SHA512

    9a7b7746aa1b377f5e5314344ddc8c0ff827c5f37fe0f99df55da078f965e68d4099db959097fa7ce456176be496b749d8fce42df847fa95e0c5f7f927db4c54

  • SSDEEP

    6144:j7j7AupjIIwH5OalEVFvlmfDR2Cnsx2qPu:D0upjIIe5EVOfD9M2

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2