Extracted

• • Target
    2e31becd6f048e88711a289110b41021_JaffaCakes118
  • Size 10.0MB
  • SHA256 f9184e1c98e13ad7ac25e5fdcf56bb27988775d2a9be11df778ae7b9639ce083
  • MD5 2e31becd6f048e88711a289110b41021
  • SHA1 167fde1d6dfef1f02c8ab9d5e1abb9c7c8188acf
  • SHA512 cbea83dd37619d954cb7a7825c97e70bf488d802622be355d56c0680c2c71b214ad23a4eca4c46ed22dd60998c4026e66556e59b40589524eabb165696da151a
  • SSDEEP 98304:SEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE0:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2