Extracted

• • Target

    JaffaCakes118_0f7f7ec9c469f0b7839ad8da6b4d0c97cd05fe18cc99099a7bf4ce62cff18daa

  • Size

    159KB

  • MD5

    e54caf8c5b1fefb3289f1c743775a7f7

  • SHA1

    9af113a01ef46432502ab37f61e7a8fa15479a7a

  • SHA256

    0f7f7ec9c469f0b7839ad8da6b4d0c97cd05fe18cc99099a7bf4ce62cff18daa

  • SHA512

    fef0022c4d1f2c85adec44138ef89e1a2bd6117892dc1ebf5d21866828b3c3c7d0f5fdb97f5b2d965873aca280a923e781ea3c69988fd6b43c5f55b9bc1becc3

  • SSDEEP

    3072:J7+69EJhEjeblBHZ57ODtgNQT0kP+NN34Pu3/d042XL:FEJhEjeRV7ODMkP+NK2d0P

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2