Extracted

• • Target

    JaffaCakes118_63f81f8264b1f8339dd8f9d6403bcd6a36f4f84a88cc6318022654acc01a01de

  • Size

    184KB

  • MD5

    3db9deb4da0c2e98f67b21a01da5798a

  • SHA1

    0bab4573d5568dcbf457beaa2c9aa1cb086da533

  • SHA256

    63f81f8264b1f8339dd8f9d6403bcd6a36f4f84a88cc6318022654acc01a01de

  • SHA512

    577f24934aea433fd08313e01b76fb97015c57c3b7a7e56ff6259ce90f7360c44f6e508f3e3813dbd1f28bb29eeec6fa3bba3ae7a35306bc2001d32ad9999555

  • SSDEEP

    3072:sVmEokfyWvwFtJ6Y9A+MNtr0phGheXMWhsHPZPwg9IlAP4MAhgC:slokaWvYqtltYjqeXM2oPF+l88

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2