Extracted

• • Target

    JaffaCakes118_bcab11e14d281232fd89ecbd980282470b5d7c451ed76f0d6bb5509991c176ac

  • Size

    254KB

  • MD5

    3e043f2612e852802ff985d954946303

  • SHA1

    f930345bf9605d7c343067c234b5985eec755aff

  • SHA256

    bcab11e14d281232fd89ecbd980282470b5d7c451ed76f0d6bb5509991c176ac

  • SHA512

    eb7be1f0017628ad12a9f5d37c38d2cbc10f9f5c62a031b669b39fa8118e43dfd0358ace83e94d6b7159c705d32f4c5f8814cde0489a33895528fca158708956

  • SSDEEP

    3072:N0Op87yjsXyye+S0k3Ge2NnU5Z4mBwFkASvIlPfcRjOIqvMRbY8YhVccii+duBpp:dEyh2eV4mkkASgNajOILRsN/ccngHR

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2