Extracted

• • Target

    f1bdc796ba64b96cd4aaaf20ff3da0cc_JaffaCakes118

  • Size

    13.1MB

  • MD5

    f1bdc796ba64b96cd4aaaf20ff3da0cc

  • SHA1

    3853853e87d469821b136c75f4bc16b09a9c5a2b

  • SHA256

    46c879741fc6d476d4ff3edcd1b33c43c5b6107958925d706dd83fb0b1035f20

  • SHA512

    e6876df269d2c0559484e37b0da780191c45ae3a6b3d48b7dc01002e5a789e696a6fe7b9674e60d90e94bd5214a7ebb2012a3bd39bf381bc79d40aa33b5bf92a

  • SSDEEP

    24576:Vl3YWRibbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbn:

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2