Extracted

• • Target

    2025-01-03_82241fee715e83814c3be4f469b41759_mafia

  • Size

    11.8MB

  • MD5

    82241fee715e83814c3be4f469b41759

  • SHA1

    e871228cd3bcb8ff800689a24bf466ff014d06f9

  • SHA256

    7d38f460701f9a718696f544dd64ac3066ed34dd16e2bcb1badb944cd8240cbb

  • SHA512

    54804b81ddd4d5f85d0adb2b083163131776b898484b51eee413d11dc8b2030f17f0e2227a17f5896e45cf6a15265d8b53ba8d301291d10f1ab5c9842157db3a

  • SSDEEP

    3072:iLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:LOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2