Extracted

• • Target

    2e2aada4b6ae1c5393c753b9f9b6fba0_JaffaCakes118

  • Size

    254KB

  • MD5

    2e2aada4b6ae1c5393c753b9f9b6fba0

  • SHA1

    4493842c4e76d00bd16c68d656fd205cdc031cff

  • SHA256

    5893b223a7a45ece6853b1f9770b8acad72c8dcd01bdc04320aaa1d0fe2de41c

  • SHA512

    fac139a178aa1e1edd3f347b3d149731daa0f0d5dd02f82004777d6a235f6a88be1c9da300f4903d7ce6a97ebec2c008ac9562c46e65b14adec20d7f272de752

  • SSDEEP

    6144:8vmmRGQcKp2eBXCMdOG7a4hBbUNmNLGJD0fr0Fk4qU:8ekPcKp2YXZ9a4bUNmb0F3q

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2