Extracted

• • Target

    JaffaCakes118_0c0fe113bd27270861f7d4184f477bf191c9aa465dde1453c99f95e8277f80ef

  • Size

    279KB

  • MD5

    cf7ce504dad8acc06ddec7feefe9b780

  • SHA1

    3961d09dfec70d06a7040ae34af3e7fbad49e861

  • SHA256

    0c0fe113bd27270861f7d4184f477bf191c9aa465dde1453c99f95e8277f80ef

  • SHA512

    a977035e76f81c5171ec388f2e3b36dfa855c7e223768e9e0292d702fa32ea272813fe7b8ab9633258f38364ad053611fc84e391ec5261ad8c880052e6ea15ac

  • SSDEEP

    3072:TR3iuqyNHlWwCbk2KJikfHno9UW0z0gY6nXBBQWvbvPQiaDhxxMeetkkrsC9wi+t:TR3iurobQ5/nagY6RROhxxpeTr/ekI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2