Extracted

• • Target

    ab68452865d2cef1785127b8fc4d46d7_JaffaCakes118

  • Size

    10.9MB

  • MD5

    ab68452865d2cef1785127b8fc4d46d7

  • SHA1

    d79e30a28f052a8a7a60c9834ad6557e22bfc0fa

  • SHA256

    2fbab2a754bf5e3cfa4b5e6c0c024d795b94850977f3ae3d2b6b81fa2cf8cac6

  • SHA512

    93e720d1be670885f7429d9e0a4be6f39131f68202429c011a79db244083a057641d73731824593fb42175da368914b7b37df4ccd6749a34597e3f038e3e99ae

  • SSDEEP

    12288:+b22XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:K2

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2