Extracted

• • Target

    JaffaCakes118_73ce70fc473c2e6bad991731f810ba9d3ef400fd3788b4e45339068f69807b86

  • Size

    287KB

  • MD5

    508ea1cca364e2f73832dd3ef1160a84

  • SHA1

    daab9d02720b6609f64628388611d09e02433633

  • SHA256

    73ce70fc473c2e6bad991731f810ba9d3ef400fd3788b4e45339068f69807b86

  • SHA512

    39bec63482d99132d5ac18b5fdd8e22e01f5dc02b9ee458d37b2d271494356d23f6f7abe17ac020b45657fea476b52973a847005ec6ca4f1a576d2498fdc634f

  • SSDEEP

    6144:uuj9qXmzAuZ8PT6HMgTp915tMvuDH4PKa7tqY:3EXrE8PT6HMgTp96vaY77o

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2