Extracted

• • Target

    2024-12-19_6c561d7ee826330e51b8a80c25440437_mafia

  • Size

    10.1MB

  • MD5

    6c561d7ee826330e51b8a80c25440437

  • SHA1

    8bcf90e5d52f4e388b2f4e18de7a2a2b6490640f

  • SHA256

    949c70d199e8ec085e4c0072157006721a0f435640dff45384dbe28d564a1893

  • SHA512

    61b743d97759cddcba92589ca934e8afe83f84521b4670e7c4bd29248ee3b3a2accf0055a5a9a23dfdb8a16df1856898af52ecdddbfa4ffb0bb1abf258d9c707

  • SSDEEP

    3072:ALBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:dOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2