Extracted

• • Target

    JaffaCakes118_ed6a5352d6ae2913f1ac8a3e2304f11ab3e0422f96c8b594d89d031a8d6410d2

  • Size

    160KB

  • MD5

    23372be181de07142d652d0cf68d98e8

  • SHA1

    37facb53bc41fa1cc38eef318ef4dab567a4ca2a

  • SHA256

    ed6a5352d6ae2913f1ac8a3e2304f11ab3e0422f96c8b594d89d031a8d6410d2

  • SHA512

    5e0a98d7e0330146966e03b658e9f8b24e4b3f793d71ac477ede5adc44c13498285983b5967e95ce4ec5f6979370b570cd120c6152f4ba8907f7de3d7a24d66b

  • SSDEEP

    3072:ilNGUja6RgviBlN7pZk9r+k7V6hBqeAH:KGUduol9kwvFA

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2