Extracted

• • Target
    JaffaCakes118_63f81f8264b1f8339dd8f9d6403bcd6a36f4f84a88cc6318022654acc01a01de
  • Size 184KB
  • SHA256 63f81f8264b1f8339dd8f9d6403bcd6a36f4f84a88cc6318022654acc01a01de
  • MD5 3db9deb4da0c2e98f67b21a01da5798a
  • SHA1 0bab4573d5568dcbf457beaa2c9aa1cb086da533
  • SHA512 577f24934aea433fd08313e01b76fb97015c57c3b7a7e56ff6259ce90f7360c44f6e508f3e3813dbd1f28bb29eeec6fa3bba3ae7a35306bc2001d32ad9999555
  • SSDEEP 3072:sVmEokfyWvwFtJ6Y9A+MNtr0phGheXMWhsHPZPwg9IlAP4MAhgC:slokaWvYqtltYjqeXM2oPF+l88
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2