Extracted

• • Target
    574ae27407a29872371c16b4d51fc07c_JaffaCakes118
  • Size 12.6MB
  • SHA256 7567845d1f6798d471c6d9ea479b6c7c1a59540e3e6dbf150b3624cb0afc1caa
  • MD5 574ae27407a29872371c16b4d51fc07c
  • SHA1 d4c6d82d9c55553c8d855fea370c69d7c8163f36
  • SHA512 4cfc537197aa4a682470792902f3dc72f5d8a51d2ae49386e9acab34b93e16ad50932c22fd0616ff1bad8740102bf93922bda4c157afd39e3ca44a2230ec9129
  • SSDEEP 12288:zZuQ8KeZy8QXVeciP1m11111111111111111111111111111111111111111111n:z0Q8wVPk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2