Extracted

• • Target

    72b6657e5633ebdcd2b4b49b034ab0d8_JaffaCakes118

  • Size

    11.1MB

  • MD5

    72b6657e5633ebdcd2b4b49b034ab0d8

  • SHA1

    c8b0081902a005b88b18319e7488d81ab7a4d348

  • SHA256

    de2c494713e4ca980f0f55c5d183def1f1a68c698eacd6627778b704566fce14

  • SHA512

    ee9777886dad70c6d34aad658ab799668db3441ace3507ab1f686b44123206a7e8c14c7788e2260533af2eb50550c1120adaff69b886e9d75d5d92df751f6aa9

  • SSDEEP

    24576:RPTYeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeO:RP

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2