Extracted

• • Target
    915b00f6ee321f9a455dcf0a30b83b90_JaffaCakes118
  • Size 14.3MB
  • SHA256 f368d83d2a61b7f8f997de5ea34dbdc7bf407b4b53dbb60e47afac4a3b6189d5
  • MD5 915b00f6ee321f9a455dcf0a30b83b90
  • SHA1 a4419d7733580efb43bfdc80bfd793796fd875f8
  • SHA512 79921aad82afc920bdde998203b7b55f3f937d2618de3575148a68e28de0e63bfa20c5e95478e52ff15a76262714d4248894a576fe2b9b65ac069651dabdc6b1
  • SSDEEP 12288:Ghq8okPz+6/uWlQJVpppppppppppppppppppppppppppppppppppppppppppppph:/Sz+R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2