Extracted

• • Target

    271d95e58c572c43840b2821abcc4ef0_JaffaCakes118

  • Size

    143KB

  • MD5

    271d95e58c572c43840b2821abcc4ef0

  • SHA1

    45b8f42821059fab7c65139875855e99bf42678d

  • SHA256

    411c12f3ffdfc457b7e96b53eb9f82170e2d065a09157c82c879c335f80afe18

  • SHA512

    2c558900cfaab4161779b80a10197c75c0f3d001ff25b31477fdec1e3457cde1fe8d9291c9a68841956101c5f2e1ece1779ca21417ad977e206e8f27301da233

  • SSDEEP

    3072:Is6ZY7v9ocPspRvaMnY7Q0qzhBpJ6E5WcWcpxOcvocjc:yyLsXaAYQb/zV

  Score

  10^/10

  tofseeevasionexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2