Extracted

• • Target

    2024-06-18_e47cf404094bbac14300b8b6525cc895_mafia

  • Size

    11.8MB

  • MD5

    e47cf404094bbac14300b8b6525cc895

  • SHA1

    4aa8d94eca6db073799dab29a2995f41451fbf9e

  • SHA256

    2b1a7ddd00423c781fb634cc0c0503d497d87d2ea446e6ed5aea5d2519908926

  • SHA512

    903f147de2009507effe3a65b91103db46ed659c16ea2f0ee50c48101b1b34edb6f6392591ed367765567acc8e824595637be5a67788018bd80103778370852c

  • SSDEEP

    6144:z+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:z+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2