Extracted

• • Target
    f6d7c7a90429c7668bab5c0339e18e84_JaffaCakes118
  • Size 10.9MB
  • SHA256 c62d36cd6ae1a3563d49df5ab3fa5375d8781f3d5f60a90c0a2afdcae81454fa
  • MD5 f6d7c7a90429c7668bab5c0339e18e84
  • SHA1 ada7b42c5fb01651c4b9526974e953ac8e908508
  • SHA512 31e176c0847df5920eca0834ebd7cf47d5e52547f8add92398318cee17e93b74c2ebbd0b222c0586f7f008b8508c9f788141b45875af81230659507496483620
  • SSDEEP 24576:djCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeen:d/D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2