Extracted

• • Target

    JaffaCakes118_7e6602ff1c7434051e41ae25cffaf8fc0ac0a5ba5e31af197754b96df3d98a22

  • Size

    238KB

  • MD5

    88e99e937fb74c00ddd0ad4f2bd2cb6c

  • SHA1

    aa04d71a3586d4bd0e00966f7347eb420e016b67

  • SHA256

    7e6602ff1c7434051e41ae25cffaf8fc0ac0a5ba5e31af197754b96df3d98a22

  • SHA512

    5f861e16c4b7863acc8c60e8363d328f3108417be65870918a81d2f3e93d12b40d2f18ba6c6401e3035c89dd72a021393fdad6a66ae56a31283522ecad468467

  • SSDEEP

    6144:MpZQC4h2Yaltbf2O133EhKew3Oj2GYdK:OZ8altbfDEhFCfG

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2