Extracted

• • Target

    JaffaCakes118_df04156566c9fa82a9ecfcc43911f845d2e7941ffda2daa63b1fa06743a38e8d

  • Size

    285KB

  • MD5

    c2ce2df162edbe6d16c197dcce8461c1

  • SHA1

    84d5e79aaef19c342d0f7e0f4c91a4c1446c0c55

  • SHA256

    df04156566c9fa82a9ecfcc43911f845d2e7941ffda2daa63b1fa06743a38e8d

  • SHA512

    246688b91058703e24bafd27032e87f57041772ac4a44047c7a58be7c69141b1fd4d3eb443b8756c3aecd0a8de75949ec46f603f156a41afc54e5e37ce6e10b0

  • SSDEEP

    6144:KubLIkGEMVyknC38e3qJL6b9OOhxxdeTr/ekI:KWchEMVykSoL61zxd6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2