Extracted

• • Target

    1f6b89b430e231b22fcc8e9031cd0307_JaffaCakes118

  • Size

    13.2MB

  • MD5

    1f6b89b430e231b22fcc8e9031cd0307

  • SHA1

    e712dd589e73cf6ad5a6eb4d8afa9e84885a0983

  • SHA256

    74529db33360427d99adc6bf7612de131512a168d53545f358493792d5ee730b

  • SHA512

    3dbe60bb5bab9337b23f159b3553e6fe2cb17c292d8af06a13bb943b3a07ca100eaddc8f0ddd4826efde73185174de7d0caaee06966256b45f15d1e9d7b9da6e

  • SSDEEP

    6144:BrZQVnJzxj5nP76vk7wQ6udJm1lzvGCUWlnpj:dZ2zxj5nPmRQ6QgjzOCnl

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2