Extracted

• • Target

    52fc71ee762212ee681435ac2cfcea35_JaffaCakes118

  • Size

    12.7MB

  • MD5

    52fc71ee762212ee681435ac2cfcea35

  • SHA1

    2ce2840c6f1a8f9816005dfe3c0cd64758710896

  • SHA256

    e9aae4db1a7f9f0d0b66bab9b74f416fb3fc378acc1eadf328df1887662b3fc3

  • SHA512

    ddc8eaa83b079d09c81cb769bf6eedcd92d799f986b303a67e0a966a4656ea64ae9dc78ad0b3b4fb65369a38524cb66b3b2b42a711e9347bc38014c10314a67e

  • SSDEEP

    6144:B5VCb4QuzFJpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzD:X8NKFJp

  Score

  10^/10

  tofseeevasionexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2