Extracted

• • Target

    2024-11-20_7e89eba5381aefab5f498d3c4cf79600_karagany_mafia

  • Size

    14.7MB

  • MD5

    7e89eba5381aefab5f498d3c4cf79600

  • SHA1

    c4863bbce5805debed709d06eccf9fba7b5a2bc2

  • SHA256

    b01c776ea255a23b668d1821e30e75539788f8b19ca8cbb0e3aa6f731bb09f63

  • SHA512

    7962217a2af06a2c4c5756cacc35e0be78c4409518c119a3311dbe8cd6e31d2d5f30842aed1ab97fd49f0e027b7d9f188fa1b771922cce137e0df62a1bcb60af

  • SSDEEP

    6144:fXxZs2EcxJ8GD96ySzTVaFRFX53ncNnUUMMMMMMMMb5:fXzuKJ8GD96ySzTcANnQMMMMMMMb

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2