Extracted

• • Target

    2024-11-24_a78ecc2e78673cbde05577052782667b_karagany_mafia

  • Size

    12.6MB

  • MD5

    a78ecc2e78673cbde05577052782667b

  • SHA1

    02e34071dbcd50a81db917bfcd3938064832248c

  • SHA256

    ef2914c44cb8edd1d9f2d62c7998b3c0b6755cecb519a7904f646b5275daaef7

  • SHA512

    3e7d03c5d29d3a93436f42635c49b0c91f428881a9871c06623105675c87566983b05d3d2758cacfb401f1686d16988443eac5e7d6de036c683073eaa67c90f2

  • SSDEEP

    6144:RyXxZTquqxpXAdbbiFyKq3nUOcWfMMMMMMMbt:RyXzN8pXAdbbyyZtZfMMMMMMMb

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2