Extracted

• • Target
    f284271435132b9487ddf8dd41992578_JaffaCakes118
  • Size 14.2MB
  • SHA256 8a19788e6391d24385ece1dc77bb1a3f381bfd951faa17ce3925592842d19986
  • MD5 f284271435132b9487ddf8dd41992578
  • SHA1 26ec52a5e08c3370a92e47b5f43a12057cbe8616
  • SHA512 4027ec19d3371d2707855d1e709a48ac96e9c09251a57de035c5e2d0b10cb6ecdeddae9e6c235c524022ff305b794340815fa2ad40a7d6cf287f2304942a0687
  • SSDEEP 196608:0zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2