Extracted

• • Target

    12754fe20fd60bd57247b65d64d97e83_JaffaCakes118

  • Size

    13.4MB

  • MD5

    12754fe20fd60bd57247b65d64d97e83

  • SHA1

    bf98f755046fb4092788ee8821bd0c1fa0530efa

  • SHA256

    9364999d416a2de1c0b9b3bb46948e40be929418c06154cebee0602ca4e7b800

  • SHA512

    90a1f91c3c5cb12953781d502b1a3cc1b1dac3a0fc69a15e9c0abbbedf3fb05073ac64e6860002ba5d6ae9d089999bfa2a976a99b1a92e070773c81c2239e0ec

  • SSDEEP

    393216:uLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLz:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2