Extracted

• • Target

    603b77f0ac8874df7836569314c53bc4_JaffaCakes118

  • Size

    239KB

  • MD5

    603b77f0ac8874df7836569314c53bc4

  • SHA1

    a602ae142dee77dfef51a47c1cf5eafe040198bd

  • SHA256

    72eabb98b030c60e324f6234552c30a1e5732ff719add8b1108ebc7715d1784f

  • SHA512

    ef87dc2390def2f156490712f596b3f1f4016a7e59a4a3e8e9c1ade04caaaff6f2ab2648993d3de5bf740513317e6b4219b4c3acd5f49d42b42e2ad02ea6e255

  • SSDEEP

    3072:EMvoJ8oyOUQmaEa1otqKjHJSQEb/PUNnrU0vyHeN2hFRsGcPEH/UnpkWxeVxENO:EMvw8F3QDEFgIpb8U92ebznbxe4

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2