Extracted

• • Target

    2025-01-08_000902790eacc0ac293c991dcdfae295_mafia

  • Size

    14.6MB

  • MD5

    000902790eacc0ac293c991dcdfae295

  • SHA1

    58e9ba8e74cd2a5209c434c1a3d5ddfa2dae9f41

  • SHA256

    8c9d73f067077892c0ffbe4778c063fc50ad6235c6e35e08e7358bb5e6751ab3

  • SHA512

    9c9abdb9383b20f28358e8c0fcf7a4545219b5218caaf57d7dbdf93f6efb000e8d2ad135f79cabc9bfae9b33e4db37bd1fd2ba68e351523452e882f86f0ed80e

  • SSDEEP

    49152:2qE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:2qtYc3

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2