Extracted

• • Target

    0fdbeb853aaefb2dbead07ce8458e08d_JaffaCakes118

  • Size

    13.8MB

  • MD5

    0fdbeb853aaefb2dbead07ce8458e08d

  • SHA1

    85aba8325e2277ccf1eb6d409f96f756a61b9d3e

  • SHA256

    dfc50af3bf552bf40978db35241509f89361556235316756c134991a880b8cea

  • SHA512

    e1b193cd81d918af7b6772886cd6beb32b9548bc84798b3efa269040f0159d8fee4d172058995a40cf34a0659c9a89ccd4aa39c205cab844e7f2887fa1327fb2

  • SSDEEP

    49152:lIghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhn:q

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2