Extracted

• • Target

    2024-06-24_79fad093383e3c94ea3ecee506420340_mafia

  • Size

    12.4MB

  • MD5

    79fad093383e3c94ea3ecee506420340

  • SHA1

    e82c29ce35cfe3e30a10853335db090c65e5677a

  • SHA256

    9400d92d71e8ba8516cbe64f0c7f9bb96f2cf53a80d0ccf6a8395dd756e02578

  • SHA512

    e4a142dcadb98b35daac5287575cb9d8706e5294b35dc82d1aa6b0c45743e5555c52cb6b979f5cf529c37bd2a1cc8fb8b65db57c47f202aed6f3e6af5857ee83

  • SSDEEP

    6144:m+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:m+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2