Extracted

• • Target
    15d4d4bc8ed67fa74d66fe6916c31b90_JaffaCakes118
  • Size 239KB
  • SHA256 721e647c410d5b1a11fa7f0cf738fd5ebae93e22a3603ef717534eb127534b77
  • MD5 15d4d4bc8ed67fa74d66fe6916c31b90
  • SHA1 60822f14ffc83bf592cf8680d7ee76e132288811
  • SHA512 d66c56e07838c4d87f5bcf728cf4780bcc5d9cc509e40816d7518760f97ebe7394935a9fe7eba5b30e2d3ae201b07cdd26491c75ac798ed5fd74fe72ce0470f7
  • SSDEEP 6144:fesoFeYHECHsLsx6mihb12P5qpWV0m68jM7LjmpeM:fnu/HECz6S5QWlnqOpe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2