Extracted

• • Target

    2024-11-10_5c3d80a6c3a15ff810dbb03994bc7d16_mafia

  • Size

    10.7MB

  • MD5

    5c3d80a6c3a15ff810dbb03994bc7d16

  • SHA1

    8639cca039a2b2eb900fd302874c940220f3614c

  • SHA256

    00dbd1a4b6930e88c337b07643a2bd07ca484abc06e9a9e58f2d4eb3efabc513

  • SHA512

    d5911c0f13a438e3e89b0856745e5d62c959f59746b64722e15e92b6747d8c6b2465f8754e09dc0d2775b6b731fa001efafd02b2885ed78a643a96e8d36b8d8e

  • SSDEEP

    49152:4Vdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGf:4Vdrl/9zG

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2