Extracted

• • Target

    eb8a612690e24c3f087515f9a46a9fb0_JaffaCakes118

  • Size

    109KB

  • MD5

    eb8a612690e24c3f087515f9a46a9fb0

  • SHA1

    21d872dda244b67de9edc4942f7295d69616fa78

  • SHA256

    2f5e67e49830e1dd0ca7de24e7cc02541246a74d7adeab3e5eae0c85c9f17860

  • SHA512

    08d50e17ed8685d27a17161f57a7b6a77df31fd7d63fa09cdeb32a8e581da9df15302477e954024d3a0f67af4ab864bed18d891b65ccdc298233a7f183b27253

  • SSDEEP

    1536:kok+6RyYuguJ+BsxKlb0Tz7OO2GHWy4TmQsd1B8HdezI0mF2jbxWGq6:kojey0uJTxKZUOOhICXU+hS2jbxWGq

  Score

  10^/10

  tofseediscoverypersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2