Extracted

• • Target

    2025-01-11_eeeca1b4e9362ebcc28e6c9fbb4d5024_mafia

  • Size

    14.3MB

  • MD5

    eeeca1b4e9362ebcc28e6c9fbb4d5024

  • SHA1

    775c4131d4c97428456f30e07978408af1f73c9f

  • SHA256

    fb858d0d599cc3bc777d15f30c9bbc1661dc364da678017179cef81965949780

  • SHA512

    293efe608649c38be1b33145684c79eef16af4f07984ad4ece1a631c9fcc917990f3bc16010110725b474ee7833902b45357ef69e120a314b89600f753bb08b3

  • SSDEEP

    24576:lEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZT:ufot

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2