Extracted

• • Target

    2024-11-29_2a1f3a16c68220b3a55423794aeefa6a_karagany_mafia

  • Size

    14.9MB

  • MD5

    2a1f3a16c68220b3a55423794aeefa6a

  • SHA1

    219214490634b717b98da3f5db87cd37d48b7def

  • SHA256

    c7c2d0d51dcc6117daae7614b4668b764eb7911f5fb09a5e0f05295a2ef9b202

  • SHA512

    88bb9f65d5f87013729bc36eefe85aaac7778417a8e3f51626b5c1deef86d9b9ec0811fb40b13b5d1e3d692f04462f40ae14fb9011d4ac91fba6b81b8f868a28

  • SSDEEP

    6144:fXxZs2EcxJ8GD96ySzTVaFRFX53ncNnUUMMMMMMMMb5:fXzuKJ8GD96ySzTcANnQMMMMMMMb

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2