Extracted

• • Target

    24f65dcc42b6801b30a7eb679b571372_JaffaCakes118

  • Size

    14.3MB

  • MD5

    24f65dcc42b6801b30a7eb679b571372

  • SHA1

    cc39a9bc20d111ea4654e326774cb74d84abd3cd

  • SHA256

    be5f6be838cda666934c8154d4f504f55af259d4bd3642406c539148e673a905

  • SHA512

    d21b631b35140f7d24910857cc45fee17dd2b64d05cde3469d27d7b00a603225d73b88af80ac48d4b4055ce881224fcaceab2cb0516b0044b96ce55730ee628e

  • SSDEEP

    196608:CvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvP:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2