Extracted

• • Target

    2024-07-01_6715d07a7cac2eb14e9dbf43ea9817f3_mafia

  • Size

    13.2MB

  • MD5

    6715d07a7cac2eb14e9dbf43ea9817f3

  • SHA1

    36c8911ad3c835d4cdea03e2263cfc6423501210

  • SHA256

    24c40cf3cb1f4373c84a318ddb3a79299adad8a8a072d2ea179ebd6f127d620f

  • SHA512

    cb3ffc8dc574273850a84a01a9ffb24ceb458a8e19cd3b02b5ac9806efa13824f29e364be7fe4d62725dc6e7757a8d4994a2fa51549b0a7b1444fc6a8fd4a5d0

  • SSDEEP

    6144:x+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:x+r1IeSXMXc7LlxWV4Ug97GZ+ej

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2