Extracted

• • Target

    2025-01-10_a60ac9f9f8401b075313d1ea5ed38a3d_mafia

  • Size

    13.6MB

  • MD5

    a60ac9f9f8401b075313d1ea5ed38a3d

  • SHA1

    a399ae72488052b9a5b629b0bc9d5c47e4b503e3

  • SHA256

    48cd6c50ceff5d85c03b03b9864b6631983bf8b5a0b2a599857b924aad773da0

  • SHA512

    33dbb5926885e65db4ba08ecd4595f945e77062ab3932d4a58a2b53ca07391c2256a3d5a3349deb76d45bedee7800a3e1160f60893b5baa9aa99812167a3871a

  • SSDEEP

    24576:C6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ3:LWdLQk

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2