Extracted

• • Target

    15d4d4bc8ed67fa74d66fe6916c31b90_JaffaCakes118

  • Size

    239KB

  • MD5

    15d4d4bc8ed67fa74d66fe6916c31b90

  • SHA1

    60822f14ffc83bf592cf8680d7ee76e132288811

  • SHA256

    721e647c410d5b1a11fa7f0cf738fd5ebae93e22a3603ef717534eb127534b77

  • SHA512

    d66c56e07838c4d87f5bcf728cf4780bcc5d9cc509e40816d7518760f97ebe7394935a9fe7eba5b30e2d3ae201b07cdd26491c75ac798ed5fd74fe72ce0470f7

  • SSDEEP

    6144:fesoFeYHECHsLsx6mihb12P5qpWV0m68jM7LjmpeM:fnu/HECz6S5QWlnqOpe

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2