Extracted

• • Target

    2024-12-26_46bbbdfd4a666961635714db78cea599_mafia

  • Size

    11.1MB

  • MD5

    46bbbdfd4a666961635714db78cea599

  • SHA1

    833ce3ae49ccde9035eebf0b064bc7e9c1642217

  • SHA256

    18ebe3f7d3f848fe6037aff6c04c6967a58dd1096357a4044a5fa81035f35d02

  • SHA512

    376915dedd4841e6dc6b7c4461d14aefd8737d549853f929a8272c3a63dfbe00901645cc0146008716c1ccf99ee07e6ca74b168c813bbda69609af984d2bd9db

  • SSDEEP

    3072:uLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:3OMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2