Extracted

• • Target

    fb73068efdfde57d29a3df074187c6ea_JaffaCakes118

  • Size

    12.5MB

  • MD5

    fb73068efdfde57d29a3df074187c6ea

  • SHA1

    8d9a6e40cde061adf51f90cedc6507e33234a637

  • SHA256

    be638ce3f50bd9363616977cf69fec3c86338df920078832a63f055f37a3f219

  • SHA512

    96889edca6938c5d8c61c042402d232f5dff0112bb735799d18bbe8fb9e6a6ffd58b9a0e681074a66fa4119c1346e2669396d649fc662f0be76c83a1097bd457

  • SSDEEP

    12288:UZnHC6Hf1kkNWoRjta3JZlPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP/:UdHCRiG

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2