Extracted

• • Target

    f152c13bba794da66f2609639299f6c4_JaffaCakes118

  • Size

    12.1MB

  • MD5

    f152c13bba794da66f2609639299f6c4

  • SHA1

    785b6a13f29846d9793681de51835b61c6630214

  • SHA256

    bfe6a26a9ce2912a847cb03cba96057caf7e87a074ed408e82de72edc9f93d5d

  • SHA512

    d6fa6df224979e2a2bcdc38d324498484d3a6be2fe3f63d3245b2cb63414479aabfce4ce93916d226339329c4fa6cc356b1e11df03eccd3ca1fac4414c16924f

  • SSDEEP

    393216:v00000000000000000000000000000000000000000000000000000000000000E:

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2