Extracted

• • Target

    4cd172768ec94c54ad538e4e07301fb8_JaffaCakes118

  • Size

    11.9MB

  • MD5

    4cd172768ec94c54ad538e4e07301fb8

  • SHA1

    f908ce00f8b7df39eb89884041b354766d3082a9

  • SHA256

    88e38a15962ba6b86297a18b6635e6774b76cc91198c5cf432b4336610e015a2

  • SHA512

    e36edff9d68b98afa0d2124b1cb5c765eca702e5c877fa8f2524a5e7a3b098bb42574d62fc56bdff0bacbc421af196460c59f198204eee490d8eb6f256f4317c

  • SSDEEP

    49152:Igntttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt/:I

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2