Extracted

• • Target
    d82fb6f76e190e7d8da96dcf40d3a22c_JaffaCakes118
  • Size 142KB
  • SHA256 e6cda788201b87ab021e3f1544fd61765081e879b52974bd993f7ba9e9271ef9
  • MD5 d82fb6f76e190e7d8da96dcf40d3a22c
  • SHA1 179419aa3c99bcad94516ca4b841be66fd8a491f
  • SHA512 7c2f790bb1a133c4d5bed66da661376104a62b717353e80d38b0467ddda0863feac7d5dba4f796848f25ac58b5e9d9441bb82f50f1ca314c68cd75201e2a595d
  • SSDEEP 3072:lX3VXWiUmL3Q+cPspRvaMnY7Q0qzhBpJ6E5WcWcecvEcpxxc:aKqsXaAYQb/zD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2