Extracted

• • Target

    26a5a30af2a8f19775fb79d1679052e6_JaffaCakes118

  • Size

    235KB

  • MD5

    26a5a30af2a8f19775fb79d1679052e6

  • SHA1

    e1cdeb1061c6770b619412e5f06dd73121354e74

  • SHA256

    6a6c76468f25ca6d92463cc715fe615b2b449468a85e9c183693d8ea5a70fff1

  • SHA512

    479196b7479b87f302a16c6e99dfaa1291be9f57f2420c1d68fcc2236d86003b3105a70b1d0b3f92d141c5c5e368a05b40a57e98f19d3cf798b852860003370a

  • SSDEEP

    3072:RHYT/V2WmOfWSnTEXvoH8Gz5sFhQ/XScsYh6gSVywo3c+:RHa5mO//H8XjiC7knGyHM

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2