Extracted

• • Target

    6c479a3713975d2c9e5e8ebfb1d9ee78_JaffaCakes118

  • Size

    11.7MB

  • MD5

    6c479a3713975d2c9e5e8ebfb1d9ee78

  • SHA1

    06475d07307cedd887d4792af33288ed7fe08524

  • SHA256

    72c549a180415c914d6ff4b0247f8a19904aacb08c4db4e24fd4e6f92af3d39c

  • SHA512

    f1e18ea6df202a7fc67470dea69a6fa275e85fbea297909b4816e01c65cb93116bb8fc1e0215e36a42d0a9d2b6ef33f7b7fa83e995157a8e0e247305b4754938

  • SSDEEP

    98304:KYTPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPX:K

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2