Extracted

• • Target

    39503374e60c2654abb01f802ad48002_JaffaCakes118

  • Size

    11.5MB

  • MD5

    39503374e60c2654abb01f802ad48002

  • SHA1

    27c79b468c04e3d97f352344455c62ff9d8cc531

  • SHA256

    451567a8338f0ac84adaf764b66486df72cc7af2c976a421c6d5e89db0d51d86

  • SHA512

    ca5442700a4b4446b2392debc2ab8d852d84a66098a7abd77266e0757ecdb09bc4f82000f2a159bdc9acafb6afc5ffc000d445f009168f41965f43829329818f

  • SSDEEP

    6144:5Nytwy0vP4gE/r4JSzyEc9T3M+0snM6rSuB:5I+XvP4Z4JSzyEg7r0snNB

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2