Extracted

• • Target

    2134b61a7f995d8a24611160d791ad5f_JaffaCakes118

  • Size

    14.8MB

  • MD5

    2134b61a7f995d8a24611160d791ad5f

  • SHA1

    e9bc86f67d55e7cbc27d74d668187467c908a7f3

  • SHA256

    931edead1df66c59790bc1168f88ffd22b62cdfb302f4c72c849b9c757e0b5f8

  • SHA512

    771e54da94b6435d0185a8c750025102047fc3323de4d493694f8d371485b060bc25e2848cd491fdde8c6a44cea628ec5fba93dd4459b3d4301f9bac9df69bcd

  • SSDEEP

    196608:6HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2