Extracted

• • Target

    29c1e4e4482eb01936de16ff0e11041c_JaffaCakes118

  • Size

    12.8MB

  • MD5

    29c1e4e4482eb01936de16ff0e11041c

  • SHA1

    69838a4c24177c6702a8d89a5c3bd83760449aaa

  • SHA256

    8fe7c06b85bc726f57b04921a0695f69520a4d639f6c718a1d2d6067d347cc67

  • SHA512

    425d09859a89aa7cac0420be192d3c3bc33d12f50e08a81c2b3eabfad89809b734d5f56ae236e1b2123ec6f62a0704a0a30b0226718d27f690ab504d071d9275

  • SSDEEP

    24576:3nrnTREWa7SX1TOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOu:RJa7M

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2