Extracted

• • Target

    JaffaCakes118_4ff0ce248a8fd30a195cc7cf0709b02c42364d30ec800f7abdff92a74417d011

  • Size

    213KB

  • MD5

    5c50519f8123fd804b2e8d74337022e6

  • SHA1

    b862cfa9f1b20d1acceb43fc2ef3a788464265c2

  • SHA256

    4ff0ce248a8fd30a195cc7cf0709b02c42364d30ec800f7abdff92a74417d011

  • SHA512

    6e362bb25221c74c955a228a30549bd22212932b81aa4ce26c26edf771227cbee0ffea2c3d9095ed4b801843a36744d7aa0f19c16786d7624d4688f12094f2ac

  • SSDEEP

    3072:H7Zt0dLUdxVjd6XsHD1brlFgYodllBgB839E/ZVStsxkgaBChopZa9uD6Vdyhkb:Vt0edxVd6XUDVxu1r39WfigaTwVf

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2