Extracted

• • Target

    JaffaCakes118_8d92811fc9063ef8c850577853a972d7a90de422bac891afb36916587f37878a

  • Size

    287KB

  • MD5

    25172811500a72cb3f5b11c4c6ac33e7

  • SHA1

    7759eb7c31b0c0cb8a382de6b6b2f9d9bea3efac

  • SHA256

    8d92811fc9063ef8c850577853a972d7a90de422bac891afb36916587f37878a

  • SHA512

    87c24014fc5cb3dd8fa3ee39a73ec82d9dd0e07ab056a4ef26924cde131a2bd3b1e33bc1f59bd776841d91a59d7388a16932e07764a947389a089f7ff6d348a9

  • SSDEEP

    1536:6wOzHMkC5wjP6kUm8sGaCvspGdWnbZNOcVjsqPrGchkchyhs8mNI5Qphsw:ck2/Z/CvsphnbZNpjserlRghs8D5ehs

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2