Extracted

• • Target
    JaffaCakes118_3004638c8e9c7e9590c0c1b1286abfbd13f773a195e8a850343e6628be166afa
  • Size 177KB
  • SHA256 3004638c8e9c7e9590c0c1b1286abfbd13f773a195e8a850343e6628be166afa
  • MD5 a3aabdff3b4a3399c1829aee537c0beb
  • SHA1 10eecc1051a96d49e0de197cd18d50f96e3ea8cb
  • SHA512 fcf179521467be64b64a8a6e5cf709c4e27edcc0e7cc6400e94d6e0feaef0a85c3913767462bfce12ecf4ab52539de41550e6d7558974a021011c658a6547cbb
  • SSDEEP 3072:o7Gc4zi7lBoiYCKegOfPS1ece1WHY2IDoN44oa+EAF:1zi7lBoFXVcPS1ecn42TN4ra+EAF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2