Extracted

• • Target

    0aa8fb62abfbb62ec43076dd164d8751_JaffaCakes118

  • Size

    98KB

  • MD5

    0aa8fb62abfbb62ec43076dd164d8751

  • SHA1

    597819616e16889167bc74372127f6eb62193212

  • SHA256

    96429043f3a30c01b205e2da6599782a864822dfb07b3cb016986c6e65a12ca5

  • SHA512

    ad6d9fdaf53afd2a2023fa0aca81e7f2fe9c3caaf249504505c8c6b7345312cd5e100663e9783d8d415aceded4be967079c0db5fb9b1bbbca0fd673e3cb21461

  • SSDEEP

    1536:rIcnFivCOLJVj7hH+sONVP/XtVtxGOBA+rRhCkQskMHUjO7pVE/AJe31ryelqa4K:rrsJHO3dnxxfrRh7QPMRa/AJKsNARFd

  Score

  10^/10

  tofseediscoverypersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2