Extracted

• • Target

    2025-01-09_bc0920bf926ce5afd4b3bddbe164c661_mafia

  • Size

    10.8MB

  • MD5

    bc0920bf926ce5afd4b3bddbe164c661

  • SHA1

    02d2615da6e80b0f12c8f5af0059034365a7e7c6

  • SHA256

    125855b740b1777ffecc46e376fba8c12e89daa1ac4d4c64c9df5ecc00380b74

  • SHA512

    56f38c84ff5439fe5301fcbc934f8a0212bb535b1e6d41d5207a2b7ce18713eda482557cfa3bec79f3ee77a2e3153c946234230070e2fae85d3a9ab67b5877b5

  • SSDEEP

    6144:1LQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQQ:GTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2