Extracted

• • Target

    5706f7eb6c5294e58aaa331b43cd5dd3_JaffaCakes118

  • Size

    10.2MB

  • MD5

    5706f7eb6c5294e58aaa331b43cd5dd3

  • SHA1

    df373d30332a8244f80074284617aaa7444404d4

  • SHA256

    a419803389ae5a08a562449126908d43d14ddff789d13950b3f793051b1a6ef7

  • SHA512

    030b41f592de764eec4031917054986d49e574956ceb1ee40cfda9013f94e06bd7c17df5b9b453167d7b116f72fa89d270c92aa96ee3be7c138a0221acbeb04d

  • SSDEEP

    6144:eJu3szifRNFyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyP:suHf7

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2