Extracted

• • Target

    2024-11-28_fedd828163ace0def6fe0de3eeeb1efe_karagany_mafia

  • Size

    14.2MB

  • MD5

    fedd828163ace0def6fe0de3eeeb1efe

  • SHA1

    1dff7ea1b1ba8ea8fcabb986c350f3a8188dc98c

  • SHA256

    bf6d3fba5f7f3ee033c1ff21f726477751b3c8934da0568a66d536bae45ce226

  • SHA512

    e5f37ea0cb0fe5cb41977763a04a61f1b95082fcc34b72682cf12311faa66b4f6ec679ff9688891b5e9f2b3b5eb3c41372742b17d6c59ea3635a2d61aceb9b3b

  • SSDEEP

    6144:IXxZs2EcxJ8GD96ySzTVaFRFX53ncNnUUMMMMMMMMb5:IXzuKJ8GD96ySzTcANnQMMMMMMMb

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2