Extracted

• • Target

    2025-01-11_2dfe303a8bce485655bbee496bdda343_mafia

  • Size

    11.2MB

  • MD5

    2dfe303a8bce485655bbee496bdda343

  • SHA1

    879b61d37204ee1b2bb55674e2bc2b187c6f57a9

  • SHA256

    ba2d6e98aa3eecb49c8f607224c64c4d6d0af080244f2320d81fdcc926452d2e

  • SHA512

    3c5c0ab522de386301c2275358ee1dda2a7e285e8b19ad32f249f26eb8c5b91ba65a46d12d1ad1dcc0b56eff4f455b8833795a5829ca85a7f5edef912b95a13f

  • SSDEEP

    24576:GpomTTN9tttttttttttttttttttttttttttttttttttttttttttttttttttttttl:Koo

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2