Extracted

• • Target
    JaffaCakes118_f4b79a481b4b93b8ec807688718d4ef72427eb9fa810e549b2b29b55feaf482a
  • Size 241KB
  • SHA256 f4b79a481b4b93b8ec807688718d4ef72427eb9fa810e549b2b29b55feaf482a
  • MD5 8866c6b22acbba4ab641339d23bdc9f3
  • SHA1 8ac8ce69741105015d7810e5e0a59cad7316fc77
  • SHA512 029dca3423be718485ad36cab810e66ba7ae4294d63c4740e4187c3d458206cf08d344460684518b06351f31ceed64c35e6dfa76ff63b04631989631ab1569dc
  • SSDEEP 3072:EQKPNMYekPTg1n87zaHWgODOwF0H2UyorPePEO/6AlXUH1v5hu5xspXrk:KPqic1n0WHgDORLkE87EVvP0xs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2