Extracted

• • Target

    03193e7ffb478a21a97774a8eceee490_JaffaCakes118

  • Size

    14.4MB

  • MD5

    03193e7ffb478a21a97774a8eceee490

  • SHA1

    9be4d7d83d855b49595e94c30b393e4a8f16a759

  • SHA256

    d9871688f45307444ebd7f8df6009abd6533db193d8eb334bb375c42e45ba366

  • SHA512

    457639d643f94b3190020c7e5f7149b1c69b4b2b486f57106722506071c29feb3b29d509a294e5c6d1603a7ed5de82c46f824c31a1a6d58aff274faaa7e6a4cd

  • SSDEEP

    196608:7E/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvH:7E

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2