Extracted

• • Target

    f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118

  • Size

    12.9MB

  • MD5

    f427dd2a74d5dc82ea884b973d2df32b

  • SHA1

    74dbbe53e39aba884a87de297cf6e71fe0a7929a

  • SHA256

    0554a5c223f9ad4748018db751a20f23589c8ed93a5f118941ea6e5a0b794cd1

  • SHA512

    0630e26f057741e8688205d3994c66429804b89aa0d72380e892aecbd275dc8f7d4cf0e2d61eb57855b50aab910208a84b125aa16f76041504e108612cfc934e

  • SSDEEP

    24576:CjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:Cnh

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2