Extracted

• • Target

    JaffaCakes118_e8a8a3ec0c1434244877d35b5c6c70ebd567d6b05cf4aa6920e5583cbe1368a3

  • Size

    198KB

  • MD5

    9f36cc0f500a4336e45f79d02b7c93bf

  • SHA1

    8b2c7738359e872dce4f0ed77f496eeab3f74ec3

  • SHA256

    e8a8a3ec0c1434244877d35b5c6c70ebd567d6b05cf4aa6920e5583cbe1368a3

  • SHA512

    33085d6f1ee3007fa665f2a4a3ca77bdc1bafbee84793569bd8aa37f6f06e8f54c85dd16fa184e5698bc2ce3f9047de4f38387c05b6e060891d528afd86aba7e

  • SSDEEP

    3072:fe68IejEfEJVHXvOZhG5uiMx4eqW3J4X/4qfP3f8DEbLB6klGfLIQVNWBz:fe2ewf4lfdyNdqfn8DEbLB6k8Txql

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2