Extracted

• • Target

    f3bd0e796e1c1b59bde69cecbde26000_JaffaCakes118

  • Size

    14.3MB

  • MD5

    f3bd0e796e1c1b59bde69cecbde26000

  • SHA1

    a3d3bd7e6d987e6cf93c97d80d86b68d2be90af8

  • SHA256

    0debd985cd0fff7744ed3165078a38bcb30b0b064ddb5b006d84f2751e0d50f9

  • SHA512

    32a1ffa73aad3303d3de5bd8766c73d8367c6e1476218df2bd801c2729e34fdacd730e34d6dc5d734d50137cc0db5e8ad0b171d63a3120d4a1b22dccd5193fb3

  • SSDEEP

    3072:DlIKxNiT/X910MzPvrmJXOWYL1DyHSHbfTYBDsopr7p85KzqyROF5LevXZUmoBZ2:DlIKziTP910Uwq1uH4gBDs8BgRn2x

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2