Extracted

• • Target

    fe27b377e9edd9ecaccec493a2d15b2c_JaffaCakes118

  • Size

    10.1MB

  • MD5

    fe27b377e9edd9ecaccec493a2d15b2c

  • SHA1

    4b4897923a21b80153888d0861baa9bfea6bc02b

  • SHA256

    cba35a2e5c88c4b433d635d3321516b95421c97a026a6b6eb19417884e1ffe50

  • SHA512

    6a2fea03da9079b8d4614fcbf148454aa820cd0cdb5b59b8407b2b216f7f672f76001873fb82be0530cb013022d0bf7c9f9eacb145e777a5c95ad2195d78949e

  • SSDEEP

    98304:K2UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU0:K

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2