Extracted

• • Target

    2024-10-08_cbe4039a430cd860ed47cdb1d3e0401a_mafia

  • Size

    13.1MB

  • MD5

    cbe4039a430cd860ed47cdb1d3e0401a

  • SHA1

    4fc93cbda5f8e8b69547b1ebc3ef3ff544bbc977

  • SHA256

    8caaa77edf1243eec9a766ad37679232215994a8d7f9d2d45d1778f4577f9a26

  • SHA512

    a0e587337edc018e39a5d5f518504f2d153738595590e1ae1b8eb75912502308dc89914393d990ead4d0b9a68d1e6ca5fbbe08bbfc9b20c34738dff7713d0fc0

  • SSDEEP

    12288:TVbj7zJB99tzBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:TJzXd

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2