Extracted

• • Target
    JaffaCakes118_a8169b1cab58e46a0c1b4627474f2d9cf23b7050a5d3ac2b8704e619b67835fc
  • Size 161KB
  • SHA256 a8169b1cab58e46a0c1b4627474f2d9cf23b7050a5d3ac2b8704e619b67835fc
  • MD5 57369a2964bae1145d8e60e93cb03a09
  • SHA1 136acbf24badc0f85b19d262349a062d517a30d6
  • SHA512 64e3bf8c255f959f7460a69f23372f5d37f4d8e31f5a097e58a11e415785cbaba97587d405b4ecd21c3b6dab88617f84b20ca2788c3dd6ca4bd15acaf7a8fd9a
  • SSDEEP 3072:4lNGUja6WGK67WLy7jMx5UI+lMMVUB6shv1sH:MGUdWGK6S7UkMVUB3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2