Extracted

• • Target

    JaffaCakes118_093d7fb822dabac4072b15f8f4703874ea5b02ccb09846f55eeb8739d7720cf7

  • Size

    296KB

  • MD5

    706b81cc3fa7c62ebf8c33571bc4c805

  • SHA1

    b4167d2b276a971f6751990083dbe46c2c1e1ac8

  • SHA256

    093d7fb822dabac4072b15f8f4703874ea5b02ccb09846f55eeb8739d7720cf7

  • SHA512

    02dee4be0c82a98498855ee642980e22acff93b597280d7be9776678cf7c56b381e5da28463a8601868c4ca32dbcd27a821a0c3b6b1e67d51b4a345c0034335e

  • SSDEEP

    6144:HfCqfoXxGFNcpT+l7ALJQaaSXuZet0yy8wu1eozh/wRi7B:GXc7cpOALiaaSXuZet0yy8wu1ecwRi

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2