Extracted

• • Target

    f9b27329a6626a54bb3c1758a117587d_JaffaCakes118

  • Size

    10.1MB

  • MD5

    f9b27329a6626a54bb3c1758a117587d

  • SHA1

    edbf73d0859efccdb4fd37fdd75ed677d69469be

  • SHA256

    01d1d4a4fd0228bd3ba6f7b6fc9c573bb38800713144ee112500f9efe2249e23

  • SHA512

    2c49782962efa7f29a4b6b466defa63ed838057e168fb874b28f67aebd68607131398403fa7ee1309c078acce0f3c087e56744b51351c6bb40100154e30184a3

  • SSDEEP

    12288:OIIW7A7qL8SHSIiwN/iZBqAsArTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTX:DA7qLNNf

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2