Extracted

• • Target

    05757f18c3d66412b7f9e21670f4f7d9_JaffaCakes118

  • Size

    10.5MB

  • MD5

    05757f18c3d66412b7f9e21670f4f7d9

  • SHA1

    14cb0395fb911e24a8342d6d42d9d21cda3c9993

  • SHA256

    c3c799982a87e0c2f562c5961561e0de269d7ae908c94d7b1483bcd901a8850b

  • SHA512

    598b20f77fe089983617e567109b6706ab5e0cf77bbc7279faae30d9dcc0fb48cd93d4ea617d0943fb00d864298bfcf546c19305f71e88719187232e3392d489

  • SSDEEP

    3072:mNoWIXVg044YmyJc/rY/2Woct6Mz+7L00vyLf9nQLWLIMcesvKeHTQzIaH/q99Q8:mNoWwy0jYBkE/vocLz+2QSLIBee8q9N

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2