Extracted

• • Target
    f020da955cab805a4f8c60f8c1a375a4_JaffaCakes118
  • Size 14.0MB
  • SHA256 7e9aa2336c370908afb719885d7cb83e3775c3a5c66712822dc984a70fdbccac
  • MD5 f020da955cab805a4f8c60f8c1a375a4
  • SHA1 905e9f614c2823c4b0b305590ee40dce6a158622
  • SHA512 e18aa565a4663d1ffd6c3255ddae1c46ec5464b965dc53f715218bcd9598303e92a74dd719d783aa5e39a2f5c4a5c33c89db30888fa0b722ae0edeefbbaae32f
  • SSDEEP 196608:ZRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRB:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2