Extracted

• • Target

    c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118

  • Size

    170KB

  • MD5

    c58a6b85fd1ecf61086b52f3a3794a1f

  • SHA1

    ab2fcc8ed5ee1d7efdfc808a8caaf54fae5b8f5f

  • SHA256

    a96551184842a79eba81afb733e1f2807f7e9fa286c90a183e0ab7e2805b6b97

  • SHA512

    7693dca5c4378b2ac57fd5e71551ca7ac740c6192f364c1a2ae987bb4b8591d3167b9a79be8f7023525c3e2335d78286331a096a70946881a301065ce69486ba

  • SSDEEP

    3072:TyyL6e5KJOUM8GXLimIolLU+tzjYvOafr2x6ZSdp/s6LIxU:TrWe8oiGnVYdfeZU21

  Score

  10^/10

  tofseediscoverypersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2