Extracted

• • Target

    f570f71d8285dce6ba5ac8ead17b0435_JaffaCakes118

  • Size

    10.4MB

  • MD5

    f570f71d8285dce6ba5ac8ead17b0435

  • SHA1

    ab4efe5cba052b2ba724222540043c90d9d6980c

  • SHA256

    62b95f3ef9cdf1e9c528d859c4d4116e114cf90b9711e1bc486ab4d034bd574e

  • SHA512

    56034472678e5d6610f1cb9b59f4b3a60c96b281b3fceb529742cdf51ec213c08e16a6b8e1748a06d461ff3d69bf7defdcac8cad10968c64d3c10135093de62f

  • SSDEEP

    6144:fpcqzKUTS5Yde/qyQK8ZtqTMIKC/eUPFwUnyaAjLo7pU6eD:PKUO54e/q60tmT7/xPFwVjs7G6

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2