Extracted

• • Target

    ae3754b598d47295114b9d099757a2fb_JaffaCakes118

  • Size

    12.0MB

  • MD5

    ae3754b598d47295114b9d099757a2fb

  • SHA1

    14d4fcad293b7bdcba0d6ef3ed30874e9ea62858

  • SHA256

    8f4b04efd604dbb28fee3ee3a894d5c6fcc9e024569fdb8cd096c810cc654f0a

  • SHA512

    419eba1237b6fedcaa5ac27d13d7da945472b06ef4afbf9bd3700c40f55f3a269060efba1a8ea4749f879a96efde47fd0f4182c3a919417aa2f28af1d1561706

  • SSDEEP

    12288:1Z+CaPfCIwUZwDu333333333333333333333333333333333333333333333333X:1cDPs

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2