Extracted

• • Target
    26f79e78a4b445e1da768ce79e82c95b_JaffaCakes118
  • Size 127KB
  • SHA256 03c3bf89ec80ccc2ebb578d871ecda58b8623d0fcaac4fc95981ea15aeaa7ba9
  • MD5 26f79e78a4b445e1da768ce79e82c95b
  • SHA1 3aedd60770c0179990df20eb9bfc81904297c10d
  • SHA512 ace209673d901058793d806c3d033d5c676d33898fc032b39b23f8c4a241694f0e7dba14968076494b64d4d687bd0391d69ab9689e46ef99d076a41983a94e39
  • SSDEEP 3072:DR9RULLkf1SfmmzUhJUVWZ3KOcPpKEK6ARbF:DZaLq1SfmmIoi6BPprKbF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2