Extracted

• • Target

    b0a59d0a8d15871ccb8be92c8d0f67f0_JaffaCakes118

  • Size

    14.1MB

  • MD5

    b0a59d0a8d15871ccb8be92c8d0f67f0

  • SHA1

    752ce7ccfee2b5de80ac420ad3df76a6b5943c84

  • SHA256

    8791519374a3ea6c961cc5bb0342e34b25b4963ff4245ba224319cb93062bcd8

  • SHA512

    dd0d8e8894423e1660e5f1a7e523192ddbf9e88f7a456a5a1547327fef792b1b086fccadead2f4d33d98a509b19de9feb5f79b24d822c6da78d0a04a832f5282

  • SSDEEP

    98304:9uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuue:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2