Extracted

• • Target

    0cfc8367505b43f71a3e388531f840ad_JaffaCakes118

  • Size

    12.3MB

  • MD5

    0cfc8367505b43f71a3e388531f840ad

  • SHA1

    666f8624dd821294c0b212f430b8a1a676b55914

  • SHA256

    f8546b64a0638ffe8267be96d09cf4790b9a89b1719b105cd99fd84e554a04da

  • SHA512

    daeb6fd6456767b77a97cfce33b9d411f77ae4259883e338caf83e329119f830132e49f30704593afbcd574b3575d5cceb299a446ea04d0cad94f89aaecaa110

  • SSDEEP

    49152:E9Yfn2sTQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQT:eYP2s

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2