Extracted

• • Target
    f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118
  • Size 10.6MB
  • SHA256 064748a64b3e6198f3f9b3821f8aa4b74ee9d687503a1e9ded2926308a86517f
  • MD5 f2500e9a3134b4790760b2ef60c0144b
  • SHA1 1c3f9aaa8988227ebad2686e977533d53e51b162
  • SHA512 ba69ce0db33d4691641f7dbdc4ae3b2a582e1a47d12d606b0ba1761bf5d442f3e772aeb7327c6ea6293144c3ccb923d86e578db6e3a96f8537584d342576173a
  • SSDEEP 24576:AerU5sWbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb7:AsW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2