Extracted

• • Target

    406385b053aa722774e90ba0d8ffcf8e_JaffaCakes118

  • Size

    12.7MB

  • MD5

    406385b053aa722774e90ba0d8ffcf8e

  • SHA1

    c4761c81a298b9003f9eca48e4918078218560f5

  • SHA256

    085d29a31f197ad5184cf4c082ea6e061ccfc1a74a700c0f989054619a123756

  • SHA512

    133a3ae858f022d512fe01070d88ac5862597dc036ed737bd9d2c5421256830d9319942057e62da7d75af3b887fa71045e4fc659a3c5bbecd86beb7f91f6db2d

  • SSDEEP

    49152:lT81MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMME:lT8

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2