Extracted

• • Target

    2205ae0550b6a87f8198eeb63ddd82e5_JaffaCakes118

  • Size

    11.0MB

  • MD5

    2205ae0550b6a87f8198eeb63ddd82e5

  • SHA1

    a4998cdd345d3763d89860241e55d318053605bd

  • SHA256

    d882cf922ed49c5c66a23925d4c102a3ca158adc11dcdabd18c0439fd8bc787b

  • SHA512

    e072de29ba82eef07ec403c73062d2a6c066aeedcb9861e5c2cd55917a076f3c2b07d152164ec2bcc68a2b5b6d9d94928768392234bd0b37959e467f1e8a268b

  • SSDEEP

    196608:gYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYX:gYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYX

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2