Extracted

• • Target

    JaffaCakes118_9f542dda8238a115cff9cf890c0f330f82d9f7431a4e1efc3836923cba8c9d39

  • Size

    282KB

  • MD5

    b702acbfb022d6d3eb92dc6ffa938123

  • SHA1

    15e926de4225ea7d6996867807d9f2fc4e61428c

  • SHA256

    9f542dda8238a115cff9cf890c0f330f82d9f7431a4e1efc3836923cba8c9d39

  • SHA512

    2067c8fb81095d2edeb357f70ccabc94f666c2c76b1ac9723e34ae0ffc857b9d91ee88af0a853f7054104eb21e1e0a6681e6192e2b8cff1419b4d5c9eb926cd4

  • SSDEEP

    6144:WMnhpeoqjbg3lNpcdjewKBh0+DjQPjG6Bhrc:WMnhpeoUbANpg4rga6Bh

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2