Extracted

• • Target

    JaffaCakes118_fe268758e415f3dc3e79f01951b6bcb1e057329c0a87f592b03b35db5481c87c

  • Size

    187KB

  • MD5

    cdae7e032a52e1ee6323c524aed411ce

  • SHA1

    877c52f37cda79f1bf610e947bafffc1227071a5

  • SHA256

    fe268758e415f3dc3e79f01951b6bcb1e057329c0a87f592b03b35db5481c87c

  • SHA512

    f45bdf62e69f3c1166ed17dd562c5aa53133b9131fce81ac0e9ad4b8260a5b7a41499aa97a6ffa4a0c10927fd28a7cd81b20a260956429b9684fd5d99e2a1fd7

  • SSDEEP

    3072:t7M4KtEHAz7pbdM9aqEI0ZVw1yE/m9yq3uGkB0PXc0GqX9Rz4mFuPbvK:Y8Az1bdM970VwwE+9yOeGc+9Rs+uTv

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2