Extracted

• • Target

    JaffaCakes118_abf95487064c4fb6b6c0e05e99a9dd70eccc3bb16d83942f43327c077d02090a

  • Size

    337KB

  • MD5

    d6776b98162419c267c5c4f8bf95ef8b

  • SHA1

    cad3f3d2153d960148239f9ce9bebbb1d364a391

  • SHA256

    abf95487064c4fb6b6c0e05e99a9dd70eccc3bb16d83942f43327c077d02090a

  • SHA512

    1ed3405323520fc4a83339e7df35fa708c26a9bd9c8684864ce95317755d61ad7420b01c94802b4bdda42addb0bfafcaa5fa1738cb735ba934c4e330ccd43789

  • SSDEEP

    6144:SCfwTAbCJYL0eE0BWN3RnzWwXy0bnQjEL81Nrv:SCfoAV0eDBq3RnzWwXyhZX

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2