Extracted

• • Target
    JaffaCakes118_ff5130d64fbb3dbe15cf06ca1bd28d5ab5983a5fe1af3b6354205b03021b0baa
  • Size 164KB
  • SHA256 ff5130d64fbb3dbe15cf06ca1bd28d5ab5983a5fe1af3b6354205b03021b0baa
  • MD5 683f74e088d0049fb003a0e21ffc9159
  • SHA1 b2e967a6b07fcacd50b26665e9c7cbb051e2503e
  • SHA512 4eee32dd38697b6e28f17235aa0a020d0996cc22b35bb9bd9f46cec8c64f1f2b79394c183c21a2f30d6c9a7c3b5074ac29ded88693e6fc59d4c457a8e6ec3ff9
  • SSDEEP 3072:vvsXt4/tRBX7iK3yV26O6a9vh5LTEnsBfQS9H6S:vkXS533OE9j0Ea
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2