Extracted

• • Target

    2024-11-04_b29c68e036c667eaa53f1d05250810aa_mafia

  • Size

    14.4MB

  • MD5

    b29c68e036c667eaa53f1d05250810aa

  • SHA1

    e7dd2c9c7126de966d0b6dc0454759dcad7e3184

  • SHA256

    3f198854ec2a1e8720d308e6543f507b8313696f4c5a659fafffb0e355f9ebf4

  • SHA512

    23a79bfbf7ff53e7b4aaee4b96b78d436d58ae966d6d17184fc39784f03283689f51e8460ace2f98ff92e435721dec49a34fb1122f08aa8cbac8b5b01c02ac4e

  • SSDEEP

    49152:eVdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGv:eVdrl/9zG

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2