Extracted

• • Target

    2024-11-06_a712770ab4dd9d92f91603ca8c6d6a15_mafia

  • Size

    10.8MB

  • MD5

    a712770ab4dd9d92f91603ca8c6d6a15

  • SHA1

    e22c98c9442ced02cd30838345111269abe47343

  • SHA256

    58a3dc39f0d2c0e812bed7d40e67cb784d778aad1f55fd5dc14ad2280c30b02d

  • SHA512

    5132db28491d14388fc4481caad34361e8f57f2faffb315a953c8e5696bd0172a32672abf492d645c2f4c0de3c54c6510667fe173e1feffbe5c39d70a859ce88

  • SSDEEP

    49152:3Vdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGv:3Vdrl/9zG

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2