Extracted

• • Target

    12f63bb5e734c4aa0f9e8862fbd0fd41_JaffaCakes118

  • Size

    12.8MB

  • MD5

    12f63bb5e734c4aa0f9e8862fbd0fd41

  • SHA1

    c9b883f38b7d47a6c15a862df950f76997370295

  • SHA256

    207afd690de9d607fc945e1fbe6c5d40d9569159641a7c52d581a6affb2f3372

  • SHA512

    9e1d7b494738fd7a05978891ee3568943278cf16087da06099359233874e6dc43d58d8ec00704a99fc579e9130ff70e4177580d08855af40e4949d5833085a65

  • SSDEEP

    12288:NdbYJ+lQMgLtAgtiMxyJFJNN0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/:PvQMwRtiMO

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2