Extracted

• • Target

    JaffaCakes118_a0d3389c0f14bfe059cafd173cd45761fb0777d8e1057313c31a772939587f72

  • Size

    187KB

  • MD5

    c153d4e45afbdee5133affb67a3acb66

  • SHA1

    35b42f301e9fc6d6eaaf5ef294f3da3e9a8aa584

  • SHA256

    a0d3389c0f14bfe059cafd173cd45761fb0777d8e1057313c31a772939587f72

  • SHA512

    1a7d3f1b97ea11589eb8669ce09e98e8f94b7d2e13bc1b35868342080dd10f288d8a116d913e50a3f1c6065833604d13778ae781aca1fd6d629b9c97ff3d11d5

  • SSDEEP

    3072:z7QkTvI0pZG/xfCcBzzNoCv+l2k80O2rMQEeUpZa9uD6Vdyhkf:g+vI0pZG/xfCANoCGAqrhUwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2