Extracted

• • Target

    JaffaCakes118_917368c18dca5da70a2ce08f415dce2a4224bcb6d59af20d5791db873d364cad

  • Size

    198KB

  • MD5

    877d8205339dfa2e4ecfb93d63f7fa23

  • SHA1

    3aa8853f92a19679cb10c325a885358713d9a00c

  • SHA256

    917368c18dca5da70a2ce08f415dce2a4224bcb6d59af20d5791db873d364cad

  • SHA512

    0a410290fad21ded397a6571e996c75f299833087f850cff0fa74cbadf6186a4a281828e6dcee96dcec94eabd28b1ed67c6a883f5f9d5afdacbb08533b7fadc7

  • SSDEEP

    3072:LHzWdaO0VDX4runRUEI5lkrcPI1ZeVRL8EuSzgz:LTWdabDXvRrncPI1qNuSzy

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2