Extracted

• • Target

    2025-01-09_c15b4cfd4cea02fc55d57af8bf070a36_mafia

  • Size

    11.5MB

  • MD5

    c15b4cfd4cea02fc55d57af8bf070a36

  • SHA1

    c8a67802d33a2363de332b3cf80942267b66eed6

  • SHA256

    cc818e8fc4d68e1d87fd4ba4e8c6cef784b1d0e0d64c2474b9dc5943287f2c6b

  • SHA512

    468bc255cfcee32fa68aca26f78e2ba561949cd13c72a3db674ad55dbde2ed9c1e49222bdb1d9d87eda81316dc8f8c1cd23b34c45c91c3c4c5b0a6deec77909a

  • SSDEEP

    6144:mLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQN:3TYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2