Extracted

• • Target

    2025-01-08_dd25f7d89c62f6b011d4781d08655106_mafia

  • Size

    14.3MB

  • MD5

    dd25f7d89c62f6b011d4781d08655106

  • SHA1

    7480b36fec2081c2eeec3e2b0e5fa21c6d71c3f2

  • SHA256

    038b0c81cc776b4a401ee39b5aa856a9de1b6cb675e3ac1af1d60bab12a89405

  • SHA512

    39f0e36c78a5e0fd5f4f22ca15eb15cebc2706188a773d6b523083e14463f4f793df527dc127fb1805df3225d54b62c735f5ff11a1bce6436ca1fa07dd67fe89

  • SSDEEP

    49152:FqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:FqtYc3

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2