Extracted

• • Target

    feb278784fd5fa7005c523d96d0ffd96_JaffaCakes118

  • Size

    13.9MB

  • MD5

    feb278784fd5fa7005c523d96d0ffd96

  • SHA1

    81c3074e1f08781abf9f8306fd5fdf8e1f8b9933

  • SHA256

    eeffceddf2c04dab253113f235d71f2a6a5fb168a2269c93dce441babc903ec0

  • SHA512

    d6bee25ebccbf39a1feb49696ed0efebb0d6e393c257ef285af001cfc5f5fa2e5175fc87c4d884b69e87d5d42d41ce40e0e7dd3344a294a6dea458c3dac72ea5

  • SSDEEP

    6144:WeeKozztQBnWJ4ZF+PAb1nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn:WeeKozCBnuA

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2