Extracted

• • Target

    f9496c106987b667046b3895dea478e6_JaffaCakes118

  • Size

    13.0MB

  • MD5

    f9496c106987b667046b3895dea478e6

  • SHA1

    569bf8c79ad8488eb03343929118a52a223f8296

  • SHA256

    ea8ca76b2aef52390b22087b4535723f4f11f82911bd78a7ed1bd6cfbdd46d8b

  • SHA512

    8ef9534565f25f5a84a37fbd4af6ee94a0d4c643b3c80481818d07645c2d4f632a325e05ae2156b118fc2315431057a988d39055ad5e2121b0fefaa1a1556f70

  • SSDEEP

    12288:3l5qOcvT9o+egMU+HoWfprc0sssssssssssssssssssssssssssssssssssssss:xcvT9ofeqrc

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2