Extracted

• • Target

    47f7499a4be2f2bca257ec130a29c799_JaffaCakes118

  • Size

    263KB

  • MD5

    47f7499a4be2f2bca257ec130a29c799

  • SHA1

    cbc60f99cb19c72c50d2a30adcc076ea29c43415

  • SHA256

    7a8aec1488799c958cf0ce303cdb68ff66ef92402e1d3f748ea1c2ae0e981af8

  • SHA512

    5f154f95c37d273548d3e3a1b95f1b46a910e1b1e98d5bb1178f2fec9058895a62e3f0376950e343a842a864c2a1e9eb2f1a72a534a41352e6671cf903e1f61f

  • SSDEEP

    6144:3QSKph/WvuGSEP72hDKp0gKq4IT6Odt+q7Q2GOSMfc9x7:3PUdWvuGSEP72hY0gKI6s/1JI

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2