Extracted

• • Target

    ed8f416c4403957fb730b5d7098a9b38_JaffaCakes118

  • Size

    10.1MB

  • MD5

    ed8f416c4403957fb730b5d7098a9b38

  • SHA1

    a7c0c32bcb36395543ccd093c5d95bd0e4e93121

  • SHA256

    014c0a8ffe11dee61e5beb740fbc223168e83ed53fae145e25d1bda0861933c2

  • SHA512

    6dc94a0cde76db32fbfb571634ae7084d4333ab99d8ffc2ef7aeed57e8a3c7295417264106856fbd8c6c2714f261ed394a13a5877afabead30c86f5fdcb3a594

  • SSDEEP

    49152:2T81MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMc:2T8

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2