Extracted

• • Target

    JaffaCakes118_700893c0f8426f83c2731df16e089f2f463eaf91c4cd07f2feddf826a8581d10

  • Size

    332KB

  • MD5

    8b10f8df78e752a7f7185dafcf21a73a

  • SHA1

    719fbd6bffe35110995f357ef38e4ceba1532ed8

  • SHA256

    700893c0f8426f83c2731df16e089f2f463eaf91c4cd07f2feddf826a8581d10

  • SHA512

    40f3e6727f60b50b3aa803938540ff47b14e3c1a21deef0d072bf7edc77a1ce091deadaff4505571e0fd6c227811167e5bbd1570cef5b46fee9c50299cc50835

  • SSDEEP

    6144:boO+WzjWb0yklQbZG8dn6MyrMlTJhct0rDyChIo:E5QWb0plQbZG8dn6MYiTJh7/HI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2