Extracted

• • Target

    38c2e6e7c809096dcb36e8ea89d9009c_JaffaCakes118

  • Size

    13.5MB

  • MD5

    38c2e6e7c809096dcb36e8ea89d9009c

  • SHA1

    42344f575410699204c587a55a9b05f604e54275

  • SHA256

    a53984677b2902d3935ac26b6f742969a2c686d4f98d7246eade0aa6e0ed14c5

  • SHA512

    aee6c803d1cf73370eb66c109e5b359d6cf0aa0fade0b76243537d7e711ae2b6b6028855b7b675524670c9c9ce6280d26c08055d48a6bb82896fbf062cc07a21

  • SSDEEP

    98304:3G1QbQkIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIn:22b

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2