Extracted

• • Target

    f8f54aaae74e0086b1fa46b5a84db05c_JaffaCakes118

  • Size

    10.7MB

  • MD5

    f8f54aaae74e0086b1fa46b5a84db05c

  • SHA1

    6cf69b369b4d509cf28bba17f2d5c301d53cb234

  • SHA256

    90399b9745d09290d97eb0ed45d5e518e79a4e31f8133502317fa7ce3b456bfb

  • SHA512

    37d14cf05f1d0603469b4c3cecb4517ec38bf5d22da6eb743f6d832b92ae62637f9231a2f1e01cf999ba50e3a5d858b59958e5be30f7e4d7ce734ea7ac24d980

  • SSDEEP

    6144:0POE0xjG9DJs6XBy+UP29MX6TERERERERERERERERERERERERERERERERERERERV:x1xS9RdUe9MX6

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojanupx

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2