Extracted

• • Target

    JaffaCakes118_61bca9b7bb7ff8784bb4457dabe18c22a906ca2355a1866e4e2edaea8560b6c4

  • Size

    187KB

  • MD5

    a8b1c1d06132f225e9f6bf51a34e04d6

  • SHA1

    7cce87816f01af8dd37d3174bed6dc7d6b386114

  • SHA256

    61bca9b7bb7ff8784bb4457dabe18c22a906ca2355a1866e4e2edaea8560b6c4

  • SHA512

    2c749cfa18f9ea5fad1e42d928f53a8b131423d3b3f6811e102955fea43bcbcfa6c03cc8d440c3e2188acd4c3818665356a6bef195b633ad08a681452fb6a702

  • SSDEEP

    3072:J7Xjs7nz7xT/bchc0+aHM7IdudDpwjvT1MHemjIGnipZa9uD6Vdyhkd:Bs7nz7xT/bc+IHuDNpST1MHrjPniwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2