Extracted

• • Target

    67603f228bce87b17b5f18d57e9ed789_JaffaCakes118

  • Size

    12.0MB

  • MD5

    67603f228bce87b17b5f18d57e9ed789

  • SHA1

    1487565bd34d8e478af5dfc3522476323e2a17ea

  • SHA256

    bd89ba4c450170d048d096197120db63d957a84bf4071a6e2a574a66abfb9dfe

  • SHA512

    2e5505c9918e6cee80e5ff706a94e722611006216012952fd513ff24a85997c2584e1996cd8ee1c70bc23133f94b08a867de17de8f25e7ac98659c59f5c466d8

  • SSDEEP

    12288:2b22XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:C2

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2