Extracted

• • Target

    2024-12-25_40de753ae75251c4ba1910408ad71dfc_mafia

  • Size

    13.5MB

  • MD5

    40de753ae75251c4ba1910408ad71dfc

  • SHA1

    7842fa9f32079e5b5525d77d1c1d7a87da02b340

  • SHA256

    17afeb97d4656c3c6543c32937673c8d0996e2b852811995f998bb44811fc393

  • SHA512

    39ef9e23243ad5489a253457fa77f02a6695cea351f8a63b66e36dff76c5dfc198253decf7268f1b28bd8e296ea4d484f7d6aac4eed5b0cc05629a36f2c1cd58

  • SSDEEP

    3072:vLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:mOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2