Extracted

• • Target

    JaffaCakes118_e8fd4d782183a9590a96686523c41f92639134637d61b570684b6129820b97fd

  • Size

    284KB

  • MD5

    75a99af8b7adc1c07232691950cad2e7

  • SHA1

    b3cef4475010055358938a59e12c0ada3d132848

  • SHA256

    e8fd4d782183a9590a96686523c41f92639134637d61b570684b6129820b97fd

  • SHA512

    1f35004baa00e4f3cc07102adc1315d27ba69a2f3560d09dc040cf7eb332d2497d4198d5b9df7996f752f799892e900d486a85b01a3c47bd421f31ae8d730d56

  • SSDEEP

    3072:yedoQKDodNgQQ/rHaTbw5VUXv3x0o3/yc7QkNaXurRq3+R7H8gF2yMzuFUkfEVYE:j6QKIBQEbw3wv/wGw+R7c2nM6F4VD

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2