Extracted

• • Target

    0193889a235929497ee1d5971dae0697_JaffaCakes118

  • Size

    12.0MB

  • MD5

    0193889a235929497ee1d5971dae0697

  • SHA1

    cd26bd7c8a64af37899b120113bbc40aa11a7ad4

  • SHA256

    ee1eb769f85ba3319c87eccf1dda1ae11bf5e63edd9a96be26b3356753d055e1

  • SHA512

    8efc9de2f6dad7d29a027c75b964184b8c6a64b83ca18082a93afa2c708db199142d11047088e1dcaaf5d042395fd00ee52f43e23972e3ae9a8c8ff17248984a

  • SSDEEP

    196608:yX6666666666666666666666666666666666666666666666666666666666666+:y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2