Extracted

• • Target

    JaffaCakes118_3f292c43499ee4ba98361c0f1b365a33

  • Size

    11.9MB

  • MD5

    3f292c43499ee4ba98361c0f1b365a33

  • SHA1

    0d835ff79890f1269674a1c6e25ca3b926bfe726

  • SHA256

    0548cb99d5e3f66650abba816c4a0f2e175eec00a79dbf0d72ad4732f84423cb

  • SHA512

    40f35639e5fd4a398ae5a722e5731747c65293c18e103a0987af86b1bc67bdb0f7f0cba87753a490ea50cfb512afb2c89e32eeb42ab7db97e51f5e753224c2ec

  • SSDEEP

    6144:kU7GjEC3ezR7ba5Kr6zFIKBQG18IAHORqctttttttttttttttttttttttttttttH:kU7nZzRva51z2G18IAHeq

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2