Extracted

• • Target

    JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213

  • Size

    305KB

  • MD5

    780293db2a4e08f93a62476e02d21f27

  • SHA1

    34263f7759ed4ee598240896339cbe4cac84624a

  • SHA256

    2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213

  • SHA512

    ffa7f48a2dc62beb86f2bbd0e37c60a41d8dadf4222a2593bb9bb6171c5326be5008bf96d00d65cdaeeae2923d9a4c93bbc781ddfeaefe1992b1f41a94a1b65e

  • SSDEEP

    3072:VXYXu1MVDsY2mtCnIDqMKHf5pex3ElMFvlq17hZynkHIOE4Ru5TJftDunEvhtWGE:VX9MqYtcIA/5paGMFvlq7wRRtWhZl/7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2