Extracted

• • Target

    JaffaCakes118_f5e8eb630af68376b3852ca12581990d0786053b607fc457f3a95d2b8a2d9ee6

  • Size

    328KB

  • MD5

    72be89fc9c2bd735f9b40d82ac5d3bb2

  • SHA1

    c65548b1d08b08a4d8c1715bb409d7aa22e46ec9

  • SHA256

    f5e8eb630af68376b3852ca12581990d0786053b607fc457f3a95d2b8a2d9ee6

  • SHA512

    e89142b74bcde35d67625d634b51bb1e89abfbb206c648d880909b8ed1fb0c2fe077e2bc716510dc7b4c66023bcc18d01a815db16af7ca41d772d8b6bb54d936

  • SSDEEP

    6144:ec1WtXis27paIC6bNAJIZMVfwozbBbnS32KtD+gxGPY7EL7R:enZkMDF1bnS32KtNxUga

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2