Extracted

• • Target

    2024-12-07_62d58192a77785f2b84ea8d0e7e68ff8_karagany_mafia

  • Size

    12.5MB

  • MD5

    62d58192a77785f2b84ea8d0e7e68ff8

  • SHA1

    f154f6b8d9f8192c2a5312c940a7f5496411ed97

  • SHA256

    eb0ea2494a23b87ee6c07bd492afce2f6a0481f4a160fbb67c73fe18ed01ccf7

  • SHA512

    f9c27a7a5f547780b5705969135d27de39fcbfba93b992f69c6a7ec4854cd38b33022e20912c076e6b78b55f1c050edca374869db41e76fa760c4d87cf0b85cf

  • SSDEEP

    6144:4XxZveEydmxZnXNMRaTuMUifWLKxNMMMMMMMbgb:4XzvvygxZnXxr+mxNMMMMMMMbg

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2