Extracted

• • Target

    69071a916163e2ed6f4aae9e3438c917_JaffaCakes118

  • Size

    12.3MB

  • MD5

    69071a916163e2ed6f4aae9e3438c917

  • SHA1

    0f944af914e5b4a96ee95b39993c71fd24861ff7

  • SHA256

    8cd84dc12851b50d99f1c1d389b3a67dea5879abb6a64c58f89644d6384202ac

  • SHA512

    6b586a81be7fa9cf39e66a54d7cdb19af1dea34533197f06f52315bfa64cd64c6ebcabfa38381a6a3a098e2c922e7f2fb7c77e8253179a5a77b52928e2a64582

  • SSDEEP

    49152:Q8yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyj:Q

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2