Extracted

• • Target

    f8cc259a0c835f7c01a3d4a76fbbf0e9_JaffaCakes118

  • Size

    13.4MB

  • MD5

    f8cc259a0c835f7c01a3d4a76fbbf0e9

  • SHA1

    37bd6f7e3c970355684bbe521ade1bef750cea74

  • SHA256

    d070f43729c000ac138d6666b1ec932d5b513f94fd4eeba1f549811146a25a01

  • SHA512

    fadab6c9f3a4bba02ce0ea4a967aba52ed04ce0096796bce8d2cf66ff91a45767cde6ed646d672355afc74791f377fa2c02b499c6c2eb6490f7c7674396dce63

  • SSDEEP

    24576:5Uqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmH:5F15

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2