Extracted

• • Target

    2024-09-21_f178952f1644818d0c1e3e334b749c46_mafia

  • Size

    14.5MB

  • MD5

    f178952f1644818d0c1e3e334b749c46

  • SHA1

    b650ad19d57033a81b344177935f447f08ab5bfe

  • SHA256

    df903842e22291df470826cae9a31ff44e2293ebd012c28a682f6ebfc214c1cd

  • SHA512

    3001563ad672b8c15304772002412556ba1644f0cc0fe1a983f14f4a213e90245e84fe261b1ad12c1be2c8674cf34bac92494226c7ef0d25290eee7d6079b149

  • SSDEEP

    12288:8Vbj7zJB99tzBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBJ:8JzXd

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2