Extracted

• • Target

    fee7407aceb4cdb6521f6729e4e819c3_JaffaCakes118

  • Size

    10.3MB

  • MD5

    fee7407aceb4cdb6521f6729e4e819c3

  • SHA1

    c3b6fa6d67cf29c1ba69938658b6e1f6bd6169ce

  • SHA256

    58aa25180cf5775c92f460b11fcecd58f5bc03ebd03848b1e025c09864158b1c

  • SHA512

    e6f0bb159d4f42c68229a9794cdfdcfbb2c8835d63495b4766b5fc757525cdcbe4052300e89fa7ada68212b5e1e84e0dfed71655cdf972a9bf71cb659807a8da

  • SSDEEP

    24576:XjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee+:X/D

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2