Extracted

• • Target

    JaffaCakes118_e207052ca4cc6e6eb1399833bbaabe19196ed6da4630b6d2bf6921de6b2414de

  • Size

    211KB

  • MD5

    bc894bba00f2e0828016e6f50f15225f

  • SHA1

    924afecad4084572d6a1ee0d605b371870340fc6

  • SHA256

    e207052ca4cc6e6eb1399833bbaabe19196ed6da4630b6d2bf6921de6b2414de

  • SHA512

    3706ca03998a2d0927410993b6adb9e45376fbec6df4dd927c1fd38413a43324f99d3005dc271902cc67bd83789c8ae0ab679a83d613df2544093490ac7380bb

  • SSDEEP

    3072:wSmTyA3g9f0qZxL81oIZJ1Xy0frj0LspfmeXPnr+bZPwrSx1sIb8G0dnuhgC:wSmhgbZxLkJE0fX0QZSbkSx1sIum

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2