Extracted

• • Target

    fc8f9838b702553e0ecef702ef97ce84_JaffaCakes118

  • Size

    11.9MB

  • MD5

    fc8f9838b702553e0ecef702ef97ce84

  • SHA1

    881df8e9dd0ae1c881e2b388befb16db0a55c6aa

  • SHA256

    8044cd332ec2aa866eecbec9aa0cc0dcf304b2de5772e1101366c2960e94fa40

  • SHA512

    020dd1109c79116f50a9124cafd14a1a634c1333e77b7de621ecea245c629eb607695bf56d0d9d4ebb00de5c4c6290c50b5e877c57a1251f1315f9635cbf4cc7

  • SSDEEP

    98304:kvjOF//////////////////////////////////////////////////////////n:O

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2