Extracted

• • Target

    2024-06-26_63d4972da8508414258d10652266b321_mafia

  • Size

    14.3MB

  • MD5

    63d4972da8508414258d10652266b321

  • SHA1

    f21948cf071c65e274ccda5d7f5f24692f094f22

  • SHA256

    55eb0162f40757a5f2183e8bea7f3914f28830bcc01e41ccb87709fc5c82e599

  • SHA512

    7167f8e04a409a8f913cd9a4f896154a31d152fd53f998af56b3fd9bb7771a2afef0189a4c702f99b1ecf47f8d34ea2de99a1b5dc14b84df946d0b8f73c0784d

  • SSDEEP

    6144:P+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:P+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2