Extracted

• • Target

    18840d0fd7d8bd428acafd42d8a85cf0_JaffaCakes118

  • Size

    11.6MB

  • MD5

    18840d0fd7d8bd428acafd42d8a85cf0

  • SHA1

    96aaf420d989c98f571d4609d28ab733b89ad070

  • SHA256

    a5eb7b712c179c271096f6119985b67303d0c18875f33d7ea5cf2fdbcf41dd72

  • SHA512

    628118fb72328ba29fe8d30a9f283231c4d4a1789aa4a75812c4276d475bb0734c118fe45bb6a57c1ddb6ddffdd8e42f4eb5edb8f3f4488986d4c51830ece4da

  • SSDEEP

    3072:jMvoJ8oyOUQmaEa1otqKjHJSQEb/PUNnrU0vyHeN2hFRsGcPEH/UnpkWxeVxENOY:jMvw8F3QDEFgIpb8U92ebznbxe4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2