Extracted

• • Target

    JaffaCakes118_4ce348146e4449af121aa2029454a02728bb79671576c754465e17e7bbc7aa92

  • Size

    284KB

  • MD5

    39aef8a60db843b86b52e8cc53fdcf30

  • SHA1

    87d7ae95420b166e35aad755f8068d124ca25fb2

  • SHA256

    4ce348146e4449af121aa2029454a02728bb79671576c754465e17e7bbc7aa92

  • SHA512

    c1416ddabb1564c9d4592a0902c41be83de01d9011cc46773d945c3b43585b7ee089f1804df18397e3425109fe9d3c0afae6894a81d63e4e6e273abb0ab9d430

  • SSDEEP

    6144:uKFbjAXNxyhYZtc5/Tuzbgwu6L7ITsqSigaTwVf:JbjiyCZe5runnn7s

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2