Extracted

• • Target

    2025-01-10_9e52058daec83a315865f8c90795d4c8_mafia

  • Size

    13.7MB

  • MD5

    9e52058daec83a315865f8c90795d4c8

  • SHA1

    a8cdaaeac7c10726f06d7ea25eb60964203cc39d

  • SHA256

    cdf608f60357488ef40b0977e2f39dba1f9180bc7a6f338b4500c7935faab9b3

  • SHA512

    1372a2124528d8dade2c23ffb21443d20c84a42b142b42c3262607aff8cd20ebc68410665b294c5db3c685914bfd6733fb9e1a32a39c7efd4f4573c3c95c11db

  • SSDEEP

    24576:66WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQo:zWdLQk

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2