Extracted

• • Target

    152a60c00cbfc41bd421e898e0ee7737_JaffaCakes118

  • Size

    13.0MB

  • MD5

    152a60c00cbfc41bd421e898e0ee7737

  • SHA1

    78f3cb1db0829bfd6fdc1e6dabfc1abd52d4dd64

  • SHA256

    f3d4d7d949b580549377e738825b62201df2989728aa0e772397e6be1be5cb31

  • SHA512

    67f767bec4534f94d5774cfa9a80465d9902e344a89aeba24ce6a6d69a682d5283f180d3ea1d2e45c2b758be82920ae99dbbaf1bd6598ff87f6df6da5be38bd9

  • SSDEEP

    49152:jRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBr:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2