Extracted

• • Target

    JaffaCakes118_bf24720a0ed6ead9c2ec1d776bc48953e9cabc042168376cd09e9a9439f52c86

  • Size

    160KB

  • MD5

    f8fc9486f54b60f1803e7690a9a2458a

  • SHA1

    c9dd64c456997592297c283ba996410730bf7c7d

  • SHA256

    bf24720a0ed6ead9c2ec1d776bc48953e9cabc042168376cd09e9a9439f52c86

  • SHA512

    5e103634b44ceb7da4966361fed745f2604c37afd76a07631d06a8fd5903c7e58505b963bfb1aaacf24c3b4a57ae48db72cc630912826a52bbff1736bc2e19bb

  • SSDEEP

    3072:oN768L++ZHa/PtPPtMOgPljef9J9NR6vmp1n5Rw7HvON3:y681A/PtXtMHK1JQyJYLv

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2