Extracted

• • Target

    JaffaCakes118_65bc8314166799e28092cbbee1a4e3f6b0e5de9e9790107189f26f5e90a835f0

  • Size

    284KB

  • MD5

    ebc386c5e58be126d9e8317f518bde8a

  • SHA1

    d1e5459b19c9b4d8cec638a9730b38d33a57ec29

  • SHA256

    65bc8314166799e28092cbbee1a4e3f6b0e5de9e9790107189f26f5e90a835f0

  • SHA512

    9a824af4e2c3e1b5040162360a191488b311475bdf742ad9ae23cfdff158b59dad1768ccb73a2a86f77c402d6719793b7fa88d3c74a9500afca641e6cf634239

  • SSDEEP

    3072:2QWV+ioVH8ycDJdRc1/Q3RNyqUy39S20keU8/W8JMu2YaqK6nq1P93Y:VWVZ8yDJk1/QBNfP9Pu2YaqKua

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2