Extracted

• • Target

    5b73118f049b003bc2ba02bc0946d829_JaffaCakes118

  • Size

    263KB

  • MD5

    5b73118f049b003bc2ba02bc0946d829

  • SHA1

    75a8c8231ca59779f8a6ca3e2fe7d9859be5cf0e

  • SHA256

    b9c281efac7ae522f39d90a8304f29b440cdeae15c1eb53b8b1ede94f9dd19d8

  • SHA512

    2b68aba1d81d4d1764507a2dd1e23fa19f96e768ee03e158b95ca4120f73bfdcd5ac67ead2dacc7524f9d3b7bb12af2d3dbb24469f0b5964fb91706220cb98c8

  • SSDEEP

    6144:tQYgph/0NobY70xfKTm9qOYrWkRALgbWMxC7:t1Kd0NobY70xqm9qOuRNWkC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2