Extracted

• • Target

    JaffaCakes118_1891ac99238154818307b45371498641029362dfcc8fd34553814b2cc8e66ae7

  • Size

    177KB

  • MD5

    6423f85e4b535c44776aef880d374f69

  • SHA1

    deda6c4c481520b746aadd6a2cd8d2a3b2ab7387

  • SHA256

    1891ac99238154818307b45371498641029362dfcc8fd34553814b2cc8e66ae7

  • SHA512

    67e9aeeb739a022bcdd246802b7c2aafbb68a5b34d2c47b34ba4463e12304a4452447a509ac4408d2e461f9e118f419c664db9004cb0656cb2e1e5eaf818436f

  • SSDEEP

    3072:M76gzl90ytyk8oeETSOZa30H3iVr8vYSfv5fo88STbR:6l90yYxnmgKiVroYSH537TbR

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2