Extracted

• • Target

    JaffaCakes118_f38548a5d6c54e88538aabdfacbde0ee9948aec13f0550ba3f901c72725df0dd

  • Size

    209KB

  • MD5

    029139e095eb6c94f87dd5d2b74a8e3b

  • SHA1

    bd944e67580e3519b1c0e7d0978688a8f7a0c6df

  • SHA256

    f38548a5d6c54e88538aabdfacbde0ee9948aec13f0550ba3f901c72725df0dd

  • SHA512

    7de905f79271edc0856e11090901deed59525782df87a8db1af92ddaed58adae3052a3db0185f488543745330adcdf6426552f0051b8cdf8ed9427a26300fdda

  • SSDEEP

    3072:221lByeQXR4HJtywSjmkXRg6kKMdpDbW3KKiBZPwU3fB/tOvZxphgC:221lyyJtywGXRg6RMd5WsB73pOZF

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2