Extracted

• • Target

    JaffaCakes118_e270e77ba8ea40451c018d7b1c26954087ebf4d7880cbc7dc21e8822d41c217f

  • Size

    136KB

  • MD5

    0766180db106d51aafd2827ba7457f36

  • SHA1

    4121689e5a32e973cf6bc9023235138795fb708b

  • SHA256

    e270e77ba8ea40451c018d7b1c26954087ebf4d7880cbc7dc21e8822d41c217f

  • SHA512

    258becbbdf9795703d4d9c15cde791f3647178679f2157300c754e9fde8d2ad50c96eb92369202c2070bdccba7affe0335126ae2d31acb9209f039aa898e4143

  • SSDEEP

    1536:2L0xHUcaPBDfRd5FJwUOOe/Wv8ThGJNcuYhsiPBycnD5BKCJZW+s1Wjva5Y4dC8:Kag5GXOe+v+sPcuWy8D55rWtoj0Y5

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2