Extracted

• • Target

    da4efa4dc0e8934cd7c4403bde140eb9_JaffaCakes118

  • Size

    12.6MB

  • MD5

    da4efa4dc0e8934cd7c4403bde140eb9

  • SHA1

    f5af5f0393a2a75691da8831486d6bd3520dda66

  • SHA256

    5aeb6defea1c4f76eead2ea4491eddae43eb4cf08e5324c1eeb7ecfc2a98f7da

  • SHA512

    0fdad19c9bbe52715c265ba5dd0f2d5171a37cb1f573a66eed52c9fdde3aaef0523471b6579a9fbf00b925566d306aa7da9a2846dbca2d62bfc02863e7d21216

  • SSDEEP

    98304:EuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuK:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2