Extracted

• • Target

    f66228c86c71f368179321b0c382b638_JaffaCakes118

  • Size

    13.8MB

  • MD5

    f66228c86c71f368179321b0c382b638

  • SHA1

    80721fc9d9609b198517f81f09ef281e110cd7f7

  • SHA256

    02892e399fd7adc46318f48866a653013e7f70b15da1e174d405617fa6fdd816

  • SHA512

    145d0dcefebdaf7dae83ecffe66d4857ec4cea9e863b8d21f8f28fa114f376d05b7774b3184907805a6039bd0dc05042b972ead4163b3d3b3b4e990544f22998

  • SSDEEP

    98304:Pjhd88888888888888888888888888888888888888888888888888888888888Q:P

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2