Extracted

• • Target

    49af3bb83fcdf39ea968a2c246903bbc_JaffaCakes118

  • Size

    12.0MB

  • MD5

    49af3bb83fcdf39ea968a2c246903bbc

  • SHA1

    ffe28ac64c0d49e0d2c3feed88167e92510ef3fa

  • SHA256

    9134f3d1adc590ca97d990d7d26f0d20fbf3d82623be83525e4e452a6ed468b3

  • SHA512

    77fbc3b76e16e1a791617d3427b9691e92adf8297ee88f7dc2e262551d005e05a3324ccd345b428860985850c1505b0a84b443b0ad64e703f1e82cd03431d1dd

  • SSDEEP

    12288:Fb22XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:d2

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2