Extracted

• • Target

    JaffaCakes118_a16cada39e0d7162c77245f4c3814afae791422e07d0a2876cd3be173b6e3764

  • Size

    178KB

  • MD5

    daf0fb3d694f2fcc9cfafb1f82676fdc

  • SHA1

    7340cf04391200ab8eec8f9b1169401178b00f4b

  • SHA256

    a16cada39e0d7162c77245f4c3814afae791422e07d0a2876cd3be173b6e3764

  • SHA512

    12724405a8e8f2efb644b844b70550718757ce9217ba488f8d4865c7db8eb05738d1036a5df84a081c12a746966ef7971c39f119f1732693a7ec163ab09380c6

  • SSDEEP

    1536:q7v/wkGpcGl1W7QH78+w6eAlEkZnyHmbZIy6b6NsG8YknMYmed4tYl3Dhn5vMDJN:q7PGcGloEehA+M6ZTnMntYTfvMgB1R

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2