Extracted

• • Target

    JaffaCakes118_6656018d3161ad50394e69d4c4d3ebac0d75f7e4bacca2c761d727ffa8d5057c

  • Size

    300KB

  • MD5

    529139ecfc2c78c6eb3f958a8894b500

  • SHA1

    9fcb7ad0db19b7a3d01919083923024b03c2b60f

  • SHA256

    6656018d3161ad50394e69d4c4d3ebac0d75f7e4bacca2c761d727ffa8d5057c

  • SHA512

    d7d968013644d0dc15ec2133870da0843aee9c512692fad7151855b9cea6c16ad4b60348abba7ba36c01ecbf3bae233ddc6cdc2cbe8269d8d9bcedf31f5412b8

  • SSDEEP

    6144:PAWM7LTrybl7ZxTqgqJL69XOOhxxdeTr/ekI:I77XWl/TQL69bzxd6L

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2