Extracted

• • Target

    e6f23da75ee0c90e4640ee5a5ad01dda_JaffaCakes118

  • Size

    14.3MB

  • MD5

    e6f23da75ee0c90e4640ee5a5ad01dda

  • SHA1

    a08a1b7867ba74b3a7ac7eaf0d9f60c1434b9c1a

  • SHA256

    bd131e20e3604c7bf88d2f097f168cc7b0682f07b398dc7273a7ac8b0603c20e

  • SHA512

    bb355360b340952ebafeec8692f59d67bfbfdfa03e655fb18d53035722d7b6d6a751d3e78c4b5bfa839511f83a0d0c14dc48bdf740d5dc02c67a3d41d3b28562

  • SSDEEP

    196608:phKaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaav:p

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2