Extracted

• • Target
    056cf3551e97f490b0369c619be2eebe_JaffaCakes118
  • Size 14.8MB
  • SHA256 2d2f3834995473d4666f0631ecc070cedeec7989335f3c6bbab27d97a7bec42c
  • MD5 056cf3551e97f490b0369c619be2eebe
  • SHA1 e1f3c0c1e9e24829c4d8429162ab42ff4742236a
  • SHA512 23fb64872da0d92c0366159e225f6b7e2a8baa499791212d22f5a81a32433fabed02adb76cf3d38d45e4181a22e0eb71cef3e58f0416a55cb9efd7d109361de3
  • SSDEEP 6144:whs/wyHHRdbJ9yTwvobkepF5b3pi2+ETJcyIjh:whsYyHHRdbTyUwDpF515+ETN8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2