Extracted

• • Target

    e4e980a178180b5aa5f096c10e9f5557_JaffaCakes118

  • Size

    142KB

  • MD5

    e4e980a178180b5aa5f096c10e9f5557

  • SHA1

    f55b0a91c0cc81e61d6f23b8695ce4fa917f04d6

  • SHA256

    5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724

  • SHA512

    5f762ee974d14b69deb25266835644a20862f2da14f64bde6885ff27e1250b840d6cf44f3f3b36742b1502692f879382ccc59c8cab08d56b299cd8c71a3f6109

  • SSDEEP

    3072:4O8/FLfgt6rzTkYfiL2+jKfgi4m5nuGFU6W6WN06b3U:s9fzwFLnKP46uC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2