Extracted

• • Target

    fff0aab4de88fa3503e16290699ea84b_JaffaCakes118

  • Size

    11.8MB

  • MD5

    fff0aab4de88fa3503e16290699ea84b

  • SHA1

    9b6879a810a5f8609898f8f552067a237b67912b

  • SHA256

    5ff58c63e54e4bbbc6b4ec1aff3abb6275f8692a9f42a25dc9fcec70438a6bc6

  • SHA512

    3587ec145d1503bc06673592da1feca0e9d9fae5c6a968f2ee3d0ad37559a132a789d3e43205921413c5159c8aeac8789a4af0234ba894f74a04e9c436711c6e

  • SSDEEP

    98304:+NWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllx:MW

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2