Extracted

• • Target

    2024-12-31_9a334b379f1ed799035916ab0324161e_mafia

  • Size

    14.7MB

  • MD5

    9a334b379f1ed799035916ab0324161e

  • SHA1

    28c9f99a05e54c1323799fcbef2d7f74b8604aa3

  • SHA256

    5d7e40a20b0b63e723ca8e0e4da9d2d270407840030b4f91fbc2cf1625b3b04f

  • SHA512

    9528d0ec1f8abe3c7ffe4dfdece28ba75004508007ac60767d15ae62deeb0a9cbd31eafa9581581743222cf22c4690379145d3ff77b6f62f3dd41d28885bde9c

  • SSDEEP

    3072:2LBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:fOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2