Extracted

• • Target

    JaffaCakes118_f4b79a481b4b93b8ec807688718d4ef72427eb9fa810e549b2b29b55feaf482a

  • Size

    241KB

  • MD5

    8866c6b22acbba4ab641339d23bdc9f3

  • SHA1

    8ac8ce69741105015d7810e5e0a59cad7316fc77

  • SHA256

    f4b79a481b4b93b8ec807688718d4ef72427eb9fa810e549b2b29b55feaf482a

  • SHA512

    029dca3423be718485ad36cab810e66ba7ae4294d63c4740e4187c3d458206cf08d344460684518b06351f31ceed64c35e6dfa76ff63b04631989631ab1569dc

  • SSDEEP

    3072:EQKPNMYekPTg1n87zaHWgODOwF0H2UyorPePEO/6AlXUH1v5hu5xspXrk:KPqic1n0WHgDORLkE87EVvP0xs

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2