Extracted

• • Target

    47ab1157f295d159245789ec8e945d02_JaffaCakes118

  • Size

    11.2MB

  • MD5

    47ab1157f295d159245789ec8e945d02

  • SHA1

    5dd4dca6de70ba725c6628d84894b86419e3495b

  • SHA256

    50ba0727ff40b4e5d7e6199aff7bd359b5c85754b62ae2e8ffaacf5f74ea28f2

  • SHA512

    e402015c0bba748df4c7d6c40df080a1be30e670185fff4da2e73157b070d37a5bb9beed47172a5caefe44a2edffbc039e2146aa976562058e962e34833b6a2f

  • SSDEEP

    24576:7erU5sWbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbn:7sW

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2