Extracted

• • Target

    f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118

  • Size

    10.1MB

  • MD5

    f8d62bc2e174e624fd63ded004a3ca94

  • SHA1

    2b3e1baa0a7407f1627e6349d044eada991b5452

  • SHA256

    d4ca44f11b84cb185a779b6beb43f3317ffe91cf08d67a8da639764151a79d1e

  • SHA512

    7b67a2403813a48103fdda53dd665b3e96d9b859dfdfbd044e85f52bdd3e17953f044e78c22e2935e17724df8b10491f9727dbce5d88c8e37ca35f17bef565f6

  • SSDEEP

    24576:6URprj37+W55555555555555555555555555555555555555555555555555555n:1TP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2