Extracted

• • Target

    fdf33bcaac18604051afb04b0b52416f_JaffaCakes118

  • Size

    13.5MB

  • MD5

    fdf33bcaac18604051afb04b0b52416f

  • SHA1

    3a125b929ebaea43caf9700fa589d2329e38d019

  • SHA256

    1cfae1204e52198353fa94fd41d6d3496a316735d98f334eb300becdd837d90d

  • SHA512

    bd26dcdfcaa2d61498610613d5e8ca67699f234db3b906a6c982e957474c315e5cff30f9701692c0746eb8d0fab336f9f5a14cb3ffe21569004283599aad75f5

  • SSDEEP

    6144:m2BxZXDsssssssssssssssssssssssssssssssssssssssssssssssssssssssss:m4V

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2