Extracted

• • Target

    27ebcd8b19cb731bd9261b185d134619_JaffaCakes118

  • Size

    13.5MB

  • MD5

    27ebcd8b19cb731bd9261b185d134619

  • SHA1

    677b28d035bd663d7e2933b4ec307606988571f7

  • SHA256

    1a4811320f690e716efa5a7ed56af191595b018e22a94d084eec6e2c28fd2e12

  • SHA512

    660f8925d12b955935c0b3b3f0b5498faca63f43c2673a626ae785a0d0eabaacbbf90a0b222bf6abd73e27f7743fa3a2fe5bfb82907e2cc5a33d41ae67f6b416

  • SSDEEP

    98304:nYTPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPH:n

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2