Extracted

• • Target
    2024-07-09_fef73a22d5bdf052cbfbafd4fbc4ebad_mafia
  • Size 13.2MB
  • SHA256 e7b98c46e1523ea9a7d9912a4824d52108e805d831755a09933f1f0e117f0798
  • MD5 fef73a22d5bdf052cbfbafd4fbc4ebad
  • SHA1 4b214b5073466b7c5ca0087184750865701195e7
  • SHA512 f863b8f3f12b50a566c7270db111318e1e0c04f0981aafa89d14736ac9fb83f6bb197ed0cb56f7ed9387950605aa0d39d57fa65f149a6e584898ee2b3cf06c01
  • SSDEEP 6144:M+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:M+r1IeSXMXc7LlxWV4Ug97GZ+ej
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2