Extracted

• • Target

    bb99840487a3b6cd641612b2d02cd14a_JaffaCakes118

  • Size

    113KB

  • MD5

    bb99840487a3b6cd641612b2d02cd14a

  • SHA1

    6231dd81359dbc961b572ed5191756c0d8f910f9

  • SHA256

    3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06

  • SHA512

    ab420f39ef21cf0eebf395fe5506ef87ab02adab8f15366c9deecb17e5266ee88ade649e8cabc19d9538da579a2fec69983ae7e160fb48c35d21e95890112ce2

  • SSDEEP

    1536:oB8o6QvX3L4sT2eonrUL6mksUvbRDEE7a4IGh86I:oB7HPT2eoIOmnUTRQ/4k6

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2