Extracted

• • Target

    f3c6b2ff1fd4577e9a685eb2d5dd7dd7_JaffaCakes118

  • Size

    13.2MB

  • MD5

    f3c6b2ff1fd4577e9a685eb2d5dd7dd7

  • SHA1

    789b802c68ee18b75d0abdd612005ab287911d9d

  • SHA256

    f28f1200ffdf0cf7368928ab37aee6544d1093cac57000650d1c988363bc5633

  • SHA512

    54aa006a9b9a2eede1d4b72d4a23ab3b7cca0e1ae3e0a441e2fd235cccc8b365f1ce1c32f619d1bfea56da63f17eec18122de4d5a8e7dcbf476020939680976b

  • SSDEEP

    24576:gBahJbFa00000000000000000000000000000000000000000000000000000000:gOZ

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2