Extracted

• • Target

    7081bc2241e8d4803e2f17e06243d773_JaffaCakes118

  • Size

    14.5MB

  • MD5

    7081bc2241e8d4803e2f17e06243d773

  • SHA1

    81cef7c3ccbd978bdbad839d2ea6b10c719d8972

  • SHA256

    8eff3edae4ee6eca6489b3381a069390f5ed14c433029cfb0f629e6462d0b904

  • SHA512

    67863e8e8c87f3821a6fc6c69df66c2b0069ea0210fe2970814b7a508f111b8bb243669b9e09b49ab8193cdff03e9107b4dcfe753f1c951b124523dd56ec3a45

  • SSDEEP

    24576:beI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNI1lTNIH:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2