Extracted

• • Target

    557c4d35d2b818d536ec22bd4aa59bb4_JaffaCakes118

  • Size

    11.3MB

  • MD5

    557c4d35d2b818d536ec22bd4aa59bb4

  • SHA1

    bb164d817d6e48b89babfac2df525cb1bcb8daa7

  • SHA256

    8f15e641dd8747b7efc05cc65a32f51a81948a810dc95a24e6bbe6452acbcc5e

  • SHA512

    0d7f7e5cecd8147da8d9da5d2ba1d3e5640cdbb66c5763ff167fab8d8193c59521e934839aee32d2f47248a629b0fede1cfc4f2c1247b384d8fae1b2fc62a5a9

  • SSDEEP

    24576:qPTYeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeu:qP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2