Extracted

• • Target

    JaffaCakes118_67276ea315c4611e56a18ea101a6b27469386a7592364fdfa9289e13b967a323

  • Size

    164KB

  • MD5

    c5ced48e65de6d707160b2e71df898f2

  • SHA1

    0c4101e6c378d70d6e145516ff46b443aff92ea4

  • SHA256

    67276ea315c4611e56a18ea101a6b27469386a7592364fdfa9289e13b967a323

  • SHA512

    57c5a7483fc31362d691af236d3f371668aa6b3031a8e4108ebf5d8f3992bec7a00b6755e6471f9568b368aa88b1154874aaa0d50fc3c38fb74a25f2240ceacf

  • SSDEEP

    1536:BsnEEYSamXQT/PLvQtTZp9wO7BM1NvUGgwyIBtP6fm3dLi5wIbVm78d6ccJ+Rook:BhqQQBZZygw7BtfNLi57XWJS9H6Y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2