Extracted

• • Target

    2025-01-10_792e3cfa2dffd5d810b91ed078215e83_mafia

  • Size

    15.0MB

  • MD5

    792e3cfa2dffd5d810b91ed078215e83

  • SHA1

    525ce22182a5762c53562774afddeb73d6624548

  • SHA256

    74bd7dc9f31e2ed15b4a5f6b855c60bfb7e9edfa61837a49a3e12ac50a6cee93

  • SHA512

    485154fb67322713eaabeee05db0f6d2fe9a42ac1be3a896c0768c0e6d1d645db9f386901865a507938999b4567d51806ecca3cf627c2187552ccbaa98a29ac4

  • SSDEEP

    6144:0VXdWonWCgHBEJE968VNNXSB3sFD+yZpp:mbnWvHBEJM6WNNCB36D+y

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2