Extracted

• • Target
    fa7c6161052a1f948ae77285e7bf45ed_JaffaCakes118
  • Size 12.0MB
  • SHA256 cda2e2bc07f9772d45f63b77f0b0d1754b8a10fa1420b68afb10a8b71f9b8e50
  • MD5 fa7c6161052a1f948ae77285e7bf45ed
  • SHA1 366b0ba9f8fb650ff2b6e69b288037c4d2d12118
  • SHA512 66c062616dd3df436c4829ad48771b782c688066dcee9c73446d1e326efe13d4da7a253a01b8904bfd6b2fc08a782b607b843542a91175df5ec68e9b51df9ae8
  • SSDEEP 196608:4Lad4qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqn:4L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2