Extracted

• • Target

    fdf2c167e3038cd40538ca5a83bddd48_JaffaCakes118

  • Size

    14.1MB

  • MD5

    fdf2c167e3038cd40538ca5a83bddd48

  • SHA1

    ac0c3a598aa28568a5d28d1fc262207f0345c5bc

  • SHA256

    b3849e6d7b97c3d7e4f1668975783d4432a38b6d4f0c5970d9206871de2caa82

  • SHA512

    7cc57649f935d385403e1202c6774b6eda4f79f80aa07cfdd49924368a201d5f0ad3680f0086a912495b7b0db3afea2240d75a1569af99ff8676cdc4c6fb24cb

  • SSDEEP

    6144:Li0TTXfKNnKjmm+AJl6MBK0/etgnc0ArFuyXgWNInP:lKNKjmm+AJlznetgABufeI

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2