Extracted

• • Target

    fb75967066a59d021930025b7eab3a8e_JaffaCakes118

  • Size

    14.7MB

  • MD5

    fb75967066a59d021930025b7eab3a8e

  • SHA1

    b3c4760f0bec28df1e09f0c87728a84f704f8ea9

  • SHA256

    ffcb451deb32cc683c714d294ee2323c9de49a73372e7a219899baceb19caa2c

  • SHA512

    75f6875dc1c2b5d1ac368cc9f35ddd82840147550c1ec2d61b36c544782e0dc778d0237b3996319a0fc892fddb35817e8fa9b46b2ac3cd22e409ddee351f9f0d

  • SSDEEP

    6144:zngjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV5:8iOE+Nj4Q50k0UGIh+dJ

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2