Extracted

• • Target

    JaffaCakes118_1ac1ba9e387d088187f04697d6365f7b750d0883c82581d2aef0609c6060a830

  • Size

    335KB

  • MD5

    017583b1057e7938a8328077ea6798c9

  • SHA1

    216cf9f3c20d94f1b61963e1a9bfc3bbfbe10148

  • SHA256

    1ac1ba9e387d088187f04697d6365f7b750d0883c82581d2aef0609c6060a830

  • SHA512

    4b18b0cf7c43a66b8c77351ca96b992a89f0f8db0cebb3443cac413933921f44c48540729acbcf52617f901c6e873f368089febaeb0a937f8b4de97384eb1f63

  • SSDEEP

    6144:VAlVbQ7oF8g8oGQtHsdVlZYtLQLyF1nRETd:mlh4oPbjtHsdV7sQLyLyT

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2