Extracted

• • Target

    2024-12-26_db987c25ac0b684de3ed6bbec118360d_mafia

  • Size

    12.4MB

  • MD5

    db987c25ac0b684de3ed6bbec118360d

  • SHA1

    341aa3b8893a3661ac0d6ca3f5feca34d01306ba

  • SHA256

    9bf94e55f10d23d60a724a00c10f8782c10827846bc1e7315717c75b06439fc4

  • SHA512

    8d2627d560e5dc07d5e0d2756958b1405528a068d4c82bcaf8e45dc0bdf2b812c18e019de8239096955f44138542bf89085aea507427b2002f0cca281fe34730

  • SSDEEP

    3072:uLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:3OMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2