Extracted

• • Target
    7e074b12f3605bffcefa4060e08003e2_JaffaCakes118
  • Size 14.4MB
  • SHA256 1d0276aa6842ab14d2c0343d3d78454c34dfa3ca140f49ee6e3579bd9734bc1d
  • MD5 7e074b12f3605bffcefa4060e08003e2
  • SHA1 5c653b2ef1c47e3f45e022c6dad31bebfa310c42
  • SHA512 231f1805345d585a8e741a4b7f0b23092e8cc22ac13d613703bb53944ec8659bac6d68dca66b5c8b8e6d7dc701f69e106f0cbb6aa33a2c24848b4bc067a93125
  • SSDEEP 6144:engjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV7:ZiOE+Nj4Q50k0UGIh+dJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2