Extracted

• • Target

    fb337e8710c169d08e14cd2a49e016b8_JaffaCakes118

  • Size

    10.5MB

  • MD5

    fb337e8710c169d08e14cd2a49e016b8

  • SHA1

    948e1a44363e35a282d0cc14ad336529b8057af9

  • SHA256

    3719b22484738b1865755c8a80459d44eb391314565f8b5b568e8b6727d7d97a

  • SHA512

    c85ef668e4357668c100d6e3a69b2c088a24de2e04c05a98031c4fb638a265d01142b2981d3bc777eebea4f205e66b7fd3352dcbf0e73d3a6bfe7c37750a53b5

  • SSDEEP

    196608:xV8888888888888888888888888888888888888888888888888888888888888Y:b888888888888888888888888888888j

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2