Extracted

• • Target

    3fa00b58aed423cd52e2236888c40cb7_JaffaCakes118

  • Size

    12.6MB

  • MD5

    3fa00b58aed423cd52e2236888c40cb7

  • SHA1

    0284dc151760cf6bd327ff4eff80b5866128228d

  • SHA256

    0f21412ef78f4e467683b52b8936dbb8214ac36cd867bc6c0b665cf602b8b14b

  • SHA512

    df719c5cde89fd90b7042450720d370a4fd9c251e0ad6bdc69c60a50a9a206df717502728555b9466f5fdaa9a3d18e0f8a65053e121c8143cd03e6b57231b3ce

  • SSDEEP

    24576:ikVGNgVLxm55555555555555555555555555555555555555555555555555555L:/VogVq

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojanupx

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2