Extracted

• • Target

    b6eaeba05d7773789cae8999e0ecb122_JaffaCakes118

  • Size

    99KB

  • MD5

    b6eaeba05d7773789cae8999e0ecb122

  • SHA1

    1cc7c34d2c7b9a1fa8a4520b3cab8280634275f0

  • SHA256

    54e93d7ebad675c3d0495677620fa298d3d0260eb55ec175ad6bbcb80a0fd065

  • SHA512

    ac484c0b8e3e91fcd044c5609ed9c5ee402db142b3efa71b2f43b886769eb3a724a44b2ba3c520533d771c0ea9af9f077522b57c170f7081c00116e0882932b3

  • SSDEEP

    1536:R6iSAdnQAzW8omOMCUwyCq7/zWKBqlX7jUQgBEhEXgQDOvyWDWgQU+6qR:oiSAdnPzToX3k6mQ2gEQQDfLu+fR

  Score

  10^/10

  tofseeevasionexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2