Extracted

• • Target

    f36423b40d7a0bbc75a9d05f0e324e72_JaffaCakes118

  • Size

    13.2MB

  • MD5

    f36423b40d7a0bbc75a9d05f0e324e72

  • SHA1

    31f80e7d1cea645b288db9835c5e52b23fa103b2

  • SHA256

    e0e94c3fafd615c50c084cf4d72bb8f98495ad99ec2408289ae47322748120f7

  • SHA512

    fc6118271567c7697b09d7c0ef7acc50cd1867768fd06302533f96b83009c3f7f566813f20f555d628a9d2fc7c9756ca0115f32d534add97c8c66a03ed48b7a7

  • SSDEEP

    3072:Fdi8DS3tA2awlaR7/NDzFx2l0oHgBpMKwVTORO2j4UCtXGPjsjmw+V0+V0+V0+V+:a8DiApRRDzFxk0oHOpfws6Uprgp

  Score

  10^/10

  tofseeevasionpersistencetrojanupx

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2