Extracted

• • Target

    28a42f9bd803a81293892fb0cd77ddfe_JaffaCakes118

  • Size

    11.3MB

  • MD5

    28a42f9bd803a81293892fb0cd77ddfe

  • SHA1

    0f951b5cb9ee1fdd68d1c2ee29b5d81bc6804895

  • SHA256

    af0124061f4caefe4555471bc3436aecc0a957d8d3bb3695bdd431708a5c4e1e

  • SHA512

    5b7bbb0467d8aad87cced24e3b1842a6fb9045de4881fef5995515760b60a5b5f5a6516dfa44cbb3c027b7c357ce48654f7bbaed23f72413e959fabd8d51b80d

  • SSDEEP

    3072:6NoWIXVg044YmyJc/rY/2Woct6Mz+7L00vyLf9nQLWLIMcesvKeHTQzIaH/q99QI:6NoWwy0jYBkE/vocLz+2QSLIBee8q9N

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2