Extracted

• • Target

    2024-12-25_f5ef0966ceb9709a7d695f7979474cf9_mafia

  • Size

    14.0MB

  • MD5

    f5ef0966ceb9709a7d695f7979474cf9

  • SHA1

    74b0587f3eaa55eb9cfa5739ed4dabf9037e1677

  • SHA256

    49a033d771191012c9443e4f3114df4481dc58a99c1bc0de52a6c6d4254ec485

  • SHA512

    afabe7617a87900501488b861247525d0dc80022215dd1311ac18a430f95d4a5dd6f7fbfddc1615230e4948324e0d1d9c7d678de5ed61cfb09a085af52fbd9c1

  • SSDEEP

    3072:oLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:lOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2