Extracted

• • Target

    JaffaCakes118_0d3a85ef6598674399444a09d4d214a043237a6210ee28b86cf85af04bdefde8

  • Size

    335KB

  • MD5

    d164b7e53713d904c884e9ee3df58b5a

  • SHA1

    be320a568b20a7a5893ee4be349cb880f2522b82

  • SHA256

    0d3a85ef6598674399444a09d4d214a043237a6210ee28b86cf85af04bdefde8

  • SHA512

    5b7b243b55fce4b1d73058e3a8a708cbb8e18b70df52fe8823d0b62a67a23d229edbb29c0a95de2dead90a473a4b420da32b22a435267e6aa78c4ff4a12dd747

  • SSDEEP

    6144:ShdLr+GOjR+kcLTU4EGcOqYmI+Y7S5ILF84v2:SbqjR+FfU4EGr1m87S5u+4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2