Extracted

• • Target

    JaffaCakes118_c4870e799d9e991f54e556edb68a33fe3b134084ca1964be1f82f008627587c3

  • Size

    306KB

  • MD5

    1d30a5438b113d6d62bee2d8bfc32f38

  • SHA1

    bb31fba8bffd977b24d0435a8b64c9a990069358

  • SHA256

    c4870e799d9e991f54e556edb68a33fe3b134084ca1964be1f82f008627587c3

  • SHA512

    eb056fcf5f23a1e08719b910361615313b5f35eef7b579a2862b534edf617d2b60f676c98e17200ea3ef9c619b5815d4a5346c13316dff394b70528d1d0c0352

  • SSDEEP

    6144:9bjv5PFwxvAeFDJa98J9+UWMoE+aJamHFraqT41:xv5PFwxvxF39+4oBaX0qT4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2