Extracted

• • Target

    d82fb6f76e190e7d8da96dcf40d3a22c_JaffaCakes118

  • Size

    142KB

  • MD5

    d82fb6f76e190e7d8da96dcf40d3a22c

  • SHA1

    179419aa3c99bcad94516ca4b841be66fd8a491f

  • SHA256

    e6cda788201b87ab021e3f1544fd61765081e879b52974bd993f7ba9e9271ef9

  • SHA512

    7c2f790bb1a133c4d5bed66da661376104a62b717353e80d38b0467ddda0863feac7d5dba4f796848f25ac58b5e9d9441bb82f50f1ca314c68cd75201e2a595d

  • SSDEEP

    3072:lX3VXWiUmL3Q+cPspRvaMnY7Q0qzhBpJ6E5WcWcecvEcpxxc:aKqsXaAYQb/zD

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2