Extracted

• • Target

    0e7f9b3a9f76503087e94c2b5539df41_JaffaCakes118

  • Size

    12.8MB

  • MD5

    0e7f9b3a9f76503087e94c2b5539df41

  • SHA1

    325486efe485fe1506d69692d75697eb968932c7

  • SHA256

    4c6b4d2e35397d2ab57443bbd96fda25bdfb5bf932e37dd669b794c0b4222331

  • SHA512

    90eaf93a59d0c368658f9fadb48a9feb1c73cba0ce823b3a9cb0d986fd5ea2e73db82ed8b7cf2e95d15a941e4444d82b8a2f49b5a26fed4813c0beeda6638b7c

  • SSDEEP

    393216:5rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2