Extracted

• • Target
    3a8519e4f55bc93a4ffe59460d70499f_JaffaCakes118
  • Size 10.3MB
  • SHA256 aa5b8ec889dd4d8364e6f0e2b851e0a4c9100db76c2b8e3b593625d0dac2b3aa
  • MD5 3a8519e4f55bc93a4ffe59460d70499f
  • SHA1 85b43b33f7ca5f18b1e54da091a29a51680eb273
  • SHA512 0360bb359c66cba72e18898900e81bf9586b6cc166fe00465e7f3edc01d74ec00cda31d24dbde8332c4b67b23a6cd68d314ac19217bd795bd8dacac887510a8e
  • SSDEEP 49152:S88888888888888888888888888888888888888888888888888888888888888I:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2