Extracted

• • Target

    JaffaCakes118_fb19b76d60c3c16a0b43fc757f5b82bbe1a8ca37411c9a92a3ed88b4127a7272

  • Size

    284KB

  • MD5

    8dd6b66466fba9f05854ac856a968949

  • SHA1

    a51178b856523f5cb7e71ae1906577bb53b9f5d3

  • SHA256

    fb19b76d60c3c16a0b43fc757f5b82bbe1a8ca37411c9a92a3ed88b4127a7272

  • SHA512

    4092333af0319ca0fb41c1d84b1cff9c3a6a1b4b150616ade7d29016bd54a91daa5230471f15feb829e92e532ec79c33f485c15c70590cd8ebde1951ba0f8c2d

  • SSDEEP

    6144:ntxL3jo1f1cklk4+ybAy94qJL6Kq+OOhxxdeTr/ekI:nT7E1f1ckWBybtFL6wzxd6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2