Extracted

• • Target

    c493a48f9205919cba93e0841f4af186_JaffaCakes118

  • Size

    11.7MB

  • MD5

    c493a48f9205919cba93e0841f4af186

  • SHA1

    bbf59d0cc6059fba6770f53b3da639c9b715a5c2

  • SHA256

    f47c06cc9869f3b933505a5723b625a259416bc2719b7737f1a269a005f9f2bc

  • SHA512

    583cf7e4d437d0ca9b030970ceb749ab8f6c4debc9f62014e1b81c77290d67a309bb679b8e8cb9b05523e6983baa18b0b8f65ba5cb53631dd724c07da48846d1

  • SSDEEP

    196608:q3qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqC:q

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2