Extracted

• • Target

    f9e1d7d2519ce613a8c5ac3ce9c848d4_JaffaCakes118

  • Size

    13.3MB

  • MD5

    f9e1d7d2519ce613a8c5ac3ce9c848d4

  • SHA1

    c6e51f42fe2e18053ee1a292199fc371c75b69fa

  • SHA256

    ca5bb759e9f0677df3b9770fa4dc049aa3bba670a8a4a687da7c8f98ea006eaf

  • SHA512

    955166b5c8c76bed92a4d234fe0e0d84068f4f07e601095ea9ca480879c6be67d3bd59c6f59b0963cc90e1f9e24b8226c9f10c2e36b1468e1073cbae69faa8fb

  • SSDEEP

    393216:8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxL:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2