Extracted

• • Target
    bfe341b4ad6b30fbc711741e5c2fc8a6_JaffaCakes118
  • Size 14.8MB
  • SHA256 e500f5427f16ffe2ea528ff2cf9d0eae84575d3322947aa52b6178e1e60e3939
  • MD5 bfe341b4ad6b30fbc711741e5c2fc8a6
  • SHA1 713a0913520c1a899ebeeea2755ee46ea5d1862c
  • SHA512 3abb8f673c8bd09019185a371706ddc1826572704e87a7972016433a591b43c1cb8ce589fec4b495fa4ebb735423089716a192966a6988bd0947ea562c8b2321
  • SSDEEP 12288:Zb22XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:x2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2