Extracted

• • Target

    f914186ccbdfd07ad5d83756aec22683_JaffaCakes118

  • Size

    10.7MB

  • MD5

    f914186ccbdfd07ad5d83756aec22683

  • SHA1

    afbda57591f20395314fcb02dc2e8901e82109f8

  • SHA256

    dffa7c3f427791f3aeb3fe6d000d226fcafa5adefadedc8a8b030cb997d7a315

  • SHA512

    5fe1598a516bc3bd80e5214df084052ec870cf110b83fd491c94dcc44541dedb144c125e7c9957b550c82ea6a416c56acd139393f4c32d07127c65494f8b7687

  • SSDEEP

    24576:PjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeG:P/D

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2