Extracted

• • Target

    a74b062af7d84cd58eb2edb84bdda27f_JaffaCakes118

  • Size

    11.6MB

  • MD5

    a74b062af7d84cd58eb2edb84bdda27f

  • SHA1

    49883834e828cf4020279c8253c4780f078dd9c9

  • SHA256

    e52157c37dbd0ab18fc824ce8ddd986264d6366b6bea691624961fbfc4893b69

  • SHA512

    dedca1622ed514fa840e0f1c066c5bed9256a8112d3eba3eab82458d19da97b2c7625164179f8b6b82bdeb087d6be64b103665469a4e55dbaa3a64efd455e2b0

  • SSDEEP

    24576:fW93OTI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tI1/tIZ:u

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2