Extracted

• • Target

    46272a7c3e82453b849b604d502931b6_JaffaCakes118

  • Size

    14.6MB

  • MD5

    46272a7c3e82453b849b604d502931b6

  • SHA1

    d43ab2e01219f1b6b79b5c9e83a12b093a891e72

  • SHA256

    26a32c9e6d4556f1125710008c3702b6a51b8ce0419af21cd3a405673670f38e

  • SHA512

    91f62a9552002777652249b5454b551aa064b703104b1e4239a7a3713de2b1d8a8ad1e9a2ecf22c0507f74c4f2f11dbeb1da2421456c0e63b4aebf5f83b7b48a

  • SSDEEP

    49152:acUGb2222222222222222222222222222222222222222222222222222222222O:acU

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2