Extracted

• • Target

    JaffaCakes118_63c5c408d762a1b5e4fe0a4d3e0538bb3bb292fe61b986c7b6c9f7f4080cfab3

  • Size

    160KB

  • MD5

    cdc9a53f7998e1e5e4e77dd418592ad6

  • SHA1

    525c36641a284b1b5488ce8923b5f21a87ba047e

  • SHA256

    63c5c408d762a1b5e4fe0a4d3e0538bb3bb292fe61b986c7b6c9f7f4080cfab3

  • SHA512

    e31a58d9f65177ec815f0d91b46a9e854d228cfae14397255165bf248afd70e0b903bb2cb4a89193f0ee6cf8665cba8795a7aa85dfaf57de23c92cf3c5a83dd2

  • SSDEEP

    3072:U754OjNeZE6gjfPaYUf3VF9Gtmrib4R1eWvVw8Bf:4NeZE6gLYVxR1eWdw8B

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2