Extracted

• • Target

    023aefdcf5911152d6736142b76bb18e_JaffaCakes118

  • Size

    12.0MB

  • MD5

    023aefdcf5911152d6736142b76bb18e

  • SHA1

    c36f8c95bf1a1d0093ad890c708803cf27bffc4c

  • SHA256

    0edbb9de88c5727421608daa4897683ff3cec55d739ffe8c9c9a446314fe254b

  • SHA512

    323f53f30ef6860b3bd8d32d9e358124c156328d3ff66aaa75b43a801e0c292e3ad662cc807c54dd1e275c9a0cb595d6867588af49c0f16374b81d10186af14d

  • SSDEEP

    49152:XGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGn:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2