Extracted

• • Target

    6f42522b5beeb70d31d19fdf9854a81a_JaffaCakes118

  • Size

    11.8MB

  • MD5

    6f42522b5beeb70d31d19fdf9854a81a

  • SHA1

    e03a1240c6cb12b9131fb67ba7653afa743e401e

  • SHA256

    bfd52b9121ffd76cdc7eeb2cf9fa1f229700e0fd5725634390c7f2c8c572cf70

  • SHA512

    1f643ea0b547f4bd6a6cc44f0c32d1ecfadd2559d563b15c99a2279a1e68f98ce91b6f0a400330d086c24ae2f8f19a63f4f1bc3366edf412c332cf51ea1b5ed4

  • SSDEEP

    12288:oUR4+0lGrUPDHQahTzrdCcrFy55555555555555555555555555555555555555J:ol+PrmrXrd1p

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2