Extracted

• • Target
    58c96cac97ebd822ad7be1274d5bccb1_JaffaCakes118
  • Size 13.5MB
  • SHA256 70e10e0e9a41b2a5eabc89163aaa2c749dac597f380e01f92e6e08090008a57e
  • MD5 58c96cac97ebd822ad7be1274d5bccb1
  • SHA1 fd4a759cbe64f47aac53e2986eb30ccee044f42d
  • SHA512 8a29add3ec11d772bb7f26f6615a3c14cd040ca008105315aa9a9c34f2dc04e89b53b6ed9d58987205f082d5db1d7fefd977c5bb97d9f07dcdc6c07a3abd294f
  • SSDEEP 49152:3kHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2