Extracted

• • Target

    2024-11-06_67e1f186a1b891f22c2e76e7427fd639_mafia

  • Size

    12.0MB

  • MD5

    67e1f186a1b891f22c2e76e7427fd639

  • SHA1

    bbc15cb6b68329ad3de7040b8b68a684d6aa2320

  • SHA256

    ea9c33f87addc3ca9c0ee0c510a022c879a81863b3c6966e8b398a588a549b86

  • SHA512

    3b26c6053b35b44d84a2e9fb5ee50f643a1e9c8dd1562b854cf5fad655aac4cb7ed0d1496cca2cc7d7887825c0ac9a47dcbb92a65187f13048cb4a959557b620

  • SSDEEP

    49152:wVdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGu:wVdrl/9zG

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2