Extracted

• • Target

    JaffaCakes118_635c96eadf804c9514fa3c4cc93f08ccf658e32d331d7646fd1d2a2a8f80dc09

  • Size

    235KB

  • MD5

    84b6df0a9ab6a18d4810ca534b17d7cc

  • SHA1

    cf534454d4527e792dedc6a59aa4c16b2f454c7f

  • SHA256

    635c96eadf804c9514fa3c4cc93f08ccf658e32d331d7646fd1d2a2a8f80dc09

  • SHA512

    570f1e03f358bd26e634eca6539cc12fc0bad75b15448f256d16c4b55bd7677cdaa02c77afd9de4e18db9fd14384ba6f41d0b61f251c098f0725c2f3d49d3c56

  • SSDEEP

    6144:IAgL/FU4vBg9SMePSGjD6vzb7ITsqXigad:IAghUegJGj+H7R

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2