Extracted

• • Target

    f27e816769871147e4862997714586f5_JaffaCakes118

  • Size

    12.7MB

  • MD5

    f27e816769871147e4862997714586f5

  • SHA1

    6bc7cbca3c705c9da9890a8f4f5d22d273c1105a

  • SHA256

    1cb4511945d33d1414e7edf75f28952256df660a4d70e5599d8d0c653a9c44fc

  • SHA512

    710979b0bbb44401ae36b4f37d62257c5616317e6a9c66b797f10dc2b7e4f02e39a36cbd54134933c8bf6c528d79926041c66cd418d27b1ed60a9c4e35af364c

  • SSDEEP

    24576:qTmCUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:9

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2