Extracted

• • Target

    f31cde8973df6ea521b90fdf8227374e_JaffaCakes118

  • Size

    13.0MB

  • MD5

    f31cde8973df6ea521b90fdf8227374e

  • SHA1

    8bf7046fa636123c79e9e333f11c676364d038d0

  • SHA256

    bbc6f4150ca247ebe2375c8c2041830d73a2c3c09df021f2c69c5ba16b4912b8

  • SHA512

    1f20e1a8bc4914f9f774748b7d2d639506dc5d7ffdc288eb3c7f77aa8df2671c4c968dcf55f47556bee8dbe0e19c6785e538c813e7669ddd85733f82034b92e6

  • SSDEEP

    12288:awyc+f7Y47sgQhihFAXE6iPzp666666666666666666666666666666666666662:aw+f7VQhBW

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2