Extracted

• • Target
    f0571d537fdfb84ba04c35bf28fc6efd_JaffaCakes118
  • Size 13.5MB
  • SHA256 b7a610c7f989b5fc0b92106990ecf5a79c87d70f18365e2ec5b096e5e3af6379
  • MD5 f0571d537fdfb84ba04c35bf28fc6efd
  • SHA1 dd7312afd7271ca7fcda619a8d727028ffb8ba68
  • SHA512 7f4f75c788014b865497f7cf64c13db8fcc8f4b2211b716baab4d2f0d0b251f7110b598694e984b6d1cf8572323f35ea6d61100f52fbb0a2cd6cd052c59d8dcc
  • SSDEEP 24576:YjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBb:Ynh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2