Extracted

• • Target

    JaffaCakes118_cbe2de6f93b8a38d091c13ace24a93655bc4198d3ec65a5f9de58c01c8d52f37

  • Size

    296KB

  • MD5

    142a7605680f58824eeb973ced7547b6

  • SHA1

    2512decd1bdf871d20970b46d73ccd2b894ac6fa

  • SHA256

    cbe2de6f93b8a38d091c13ace24a93655bc4198d3ec65a5f9de58c01c8d52f37

  • SHA512

    80447b00d84881c4cf5240e1f7682a77c1e464dffd7f45f629935e2d0fd297f8c9634669785a5350f60d8ec8ad46c29b9ca5a1a7675eb5cdf6ba9376bb2aebed

  • SSDEEP

    6144:1EQM+a/agwAS8XfaSXuZet0yy8TUoG9FPxfdTV:1lMh/agdS8vaSXuZet0yy8wzPxfT

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2