Extracted

• • Target

    2868ba77f0519c78785327476e5d4241_JaffaCakes118

  • Size

    11.3MB

  • MD5

    2868ba77f0519c78785327476e5d4241

  • SHA1

    0206eafd872d9767073594ede672fb4483264b84

  • SHA256

    12a9b073fc13879271beb9877f6150017e5cdbc17f21983277a63958a76e6219

  • SHA512

    9f3f7d878f2fd8b5efc265bb2c4a5bf6f50039e328529cbe5ae5ea345b7abf42efd21d84b4d4644cd9bf65769d506e779924891d18b9c7b182cc6af2df757829

  • SSDEEP

    6144:dLxr3CIoKEyScf9teif2G9OYbG7kNkszTTURc1B:93/EyScPeif2GMajN1zcR

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2