Extracted

• • Target

    JaffaCakes118_92960368c0022b69350ba401b2cfa052afda7552c76ab05a64e315a53f2261a3

  • Size

    291KB

  • MD5

    bce83cac12042215bc24bedde28e1319

  • SHA1

    0a0f5ede583ea223fba4587dd3123d01dfad87fd

  • SHA256

    92960368c0022b69350ba401b2cfa052afda7552c76ab05a64e315a53f2261a3

  • SHA512

    ae43966488722a4f4e25ff268fbd10c9a078259ef44289b65da5087e26c34ff265b919decfb66dfe258fde7bf68a24703fed56c30f1235220d1dd970fd00b9ff

  • SSDEEP

    3072:101pH7yO9LeVPlZ7EoQt8Y4jMvlmM4jGeJSXuZet0ySbS1HI8MUr6BLk+r+t6Rwq:ooXjMtm/JSXuZet0ySbIHVZmBA+k6Gq

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2