Extracted

• • Target

    305372743bc24f803c3e16da163b3864_JaffaCakes118

  • Size

    12.8MB

  • MD5

    305372743bc24f803c3e16da163b3864

  • SHA1

    14bdf942d5a8d5f6e6ccbd6b11e8c9ea0ef41725

  • SHA256

    12ebfa7f053cf8a58825e9ebf857f56c64825bcb2f99e79d169bd536d7b4b112

  • SHA512

    e87336ba7fdad70a5ddb5360e0048bdd7d536fe8a7317e3ad6e2103e763cb560d2b8cd55e1b2c67116d4fc31a842dde5f47ddbd5fd33f9ee475da1fadf57fa33

  • SSDEEP

    6144:zJuDszifRNFwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww3:Nubf7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2