Extracted

• • Target

    e007ae38e3bdc05af62cfc5d5aba87cd_JaffaCakes118

  • Size

    14.4MB

  • MD5

    e007ae38e3bdc05af62cfc5d5aba87cd

  • SHA1

    31472beeea454d34bd4be93466e231cf71c6b5ce

  • SHA256

    2be4edefee6dc023948608c38015181e4e69bcf4b0ff420777b0ffefeeb26d6b

  • SHA512

    f6736b45012b5c46cce0e92699100285776c6aebad99f9fac9e5fcf18f644cb6ec250c3fb4d55581672ee46e2bf9f4c19dde38f320e0f4d5586c8a5f8b7d027c

  • SSDEEP

    49152:EwAKFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFr:Ew

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2