Extracted

• • Target
    f474b3b24c28e9731d49632cf52cb20a_JaffaCakes118
  • Size 12.5MB
  • SHA256 2c2ad8fb26b2481604773c7755cc27156ea9a7c6d19993562bd7f3f0777e3931
  • MD5 f474b3b24c28e9731d49632cf52cb20a
  • SHA1 379128e922c6174dd9fe7f16eb1428300860ae00
  • SHA512 226e7ab1d0f5894532ab390960ceb10a6c5ffff97bff475fd7282eafdcd65e4e86251893950c58e48a3e2235ca4ea32f77af44ab084956048ae0e2df0d5151a8
  • SSDEEP 98304:FNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllF:DW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2