Extracted

• • Target

    JaffaCakes118_99149d6f29cef98f470d992232c7e16a61ac0fe638fed790d7d74396fd488440

  • Size

    242KB

  • MD5

    cb3236bf34a4d42c3c120d2883670410

  • SHA1

    a0570c98e666a8e3507c9b7aba3e5467f22f91ef

  • SHA256

    99149d6f29cef98f470d992232c7e16a61ac0fe638fed790d7d74396fd488440

  • SHA512

    04898ac5a5dc5a39be98e2113bc15dbc2fe69e69651eca655a7a7f3b711c8892cf6d70eb6ff64367ef949e6b24fc07329e38c989af66709b52adc9937dbecd0b

  • SSDEEP

    6144:/rZQVnJzxj5nP76vk7wQ6udJm1lzvGCUWlnpj:DZ2zxj5nPmRQ6QgjzOCnl

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2