Extracted

• • Target

    2024-11-23_7f0aa0572a3d14406f8dcd4e6c12c1f8_karagany_mafia

  • Size

    12.4MB

  • MD5

    7f0aa0572a3d14406f8dcd4e6c12c1f8

  • SHA1

    a789428d93b23607398b372c9bd1825ad8e4ad5c

  • SHA256

    645b2c5d20c82e6d5eaf3c33a75950ce4428c843b0bc0c8d1fc7d81dad0a62f0

  • SHA512

    eee000df3ef17908f2ef33294e9d439325eadbc6382c67aba5c401286e6400584f1f6ff33b566bf603b386a916a9c7f9a3c7e12e5021c311a75ecf26f797ae4c

  • SSDEEP

    6144:IXxZs2EcxJ8GD96ySzTVaFRFX53ncNnUUMMMMMMMMb5:IXzuKJ8GD96ySzTcANnQMMMMMMMb

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2