Extracted

• • Target

    11481ac300ba2491a2d47f1afc95baca_JaffaCakes118

  • Size

    163KB

  • MD5

    11481ac300ba2491a2d47f1afc95baca

  • SHA1

    8521eea3efe6476bd4c8a6019caf09a8da211192

  • SHA256

    ad6bf90c838886a6d506e64d12cbe7682a160e6fadc0761b32a4e0de447fdd78

  • SHA512

    ca94362303dd3b1ee905bc62681b88d5d6ef9fe76e41c55473a7423a7b42ddf6bb8c4a028ea70777ea79868b58f0648ec01d61d16df2692f665b20aa6e08e0c0

  • SSDEEP

    1536:IJLacfLKE+gA1PPqW/Pi4x4t1mMOPLgj5l0QD5aXBK+cMUtoh5z1PHVSk5WZHN7Y:/2Kqx4x4t11gMtlYXsfMUS1lUyHl

  Score

  10^/10

  tofseediscoverypersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2