Extracted

• • Target

    2024-07-01_363971fcae368f8ce07971a103a074a6_mafia

  • Size

    12.3MB

  • MD5

    363971fcae368f8ce07971a103a074a6

  • SHA1

    b49dd18b2739ce13bcb1c5448b5a4f94ae7937e4

  • SHA256

    e93b25fc2f3e98f23a875044f9aef1c511c32ce591d126f4729c7434f10eab46

  • SHA512

    b218906d9faf45946714baa0dc87dc160bd26c7b169905a8b56347828e849f2e91731632c1e792425857297fe4d65dd13f9bc88a4f47ad577fb4cf102884c785

  • SSDEEP

    6144:1+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:1+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2