Extracted

• • Target

    f855c178ba66fef7013303cca97a1a4e_JaffaCakes118

  • Size

    268KB

  • MD5

    f855c178ba66fef7013303cca97a1a4e

  • SHA1

    26756ba97d394b418af1a6772a226ff2f2c18b55

  • SHA256

    e87a5c719ac7af99f1478732889d5df0a275315b42b3b9aecc8b91333bd9c0af

  • SHA512

    2ede9d6202ab29b1724fa57d3ecc947bf6fe45c1052aefdd70a6f6f53dd9e3e0ed785faaf7e05eb46fa56c327a355b92b3f2b219f0affa85d31c192b29cd2531

  • SSDEEP

    6144:jqs4O6bVLJnq2splH1e24EafBw0+8WloM+nCbVV:1sZL0dfJ4EaZZ+9oM+nmV

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2