Extracted

• • Target

    JaffaCakes118_c40a888bf1f2c26adc0edc70965d85648f22ece1f2d41a5095fb72615d954075

  • Size

    337KB

  • MD5

    3fdb21bf344606833d86102e85f00e81

  • SHA1

    ddc935d0e79e800fdd5bc962e19cfdf843d06e3f

  • SHA256

    c40a888bf1f2c26adc0edc70965d85648f22ece1f2d41a5095fb72615d954075

  • SHA512

    4fb3d015992f788df9dc880ada9c81ef83b779b47c448cc57fc40ebe41c5091ef7094b4ce737c3077f0da316873320717bc984725ea80053f9da9c06cd75c158

  • SSDEEP

    6144:dMfq+0R4E+ktkalj8LJUGfTrBOV/1vFQE0B:Ft4otkalj8LnnBOv9QEK

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2