Extracted

• • Target

    2025-01-13_8f99b8d69deb167959d1393683ef98cf_mafia

  • Size

    12.7MB

  • MD5

    8f99b8d69deb167959d1393683ef98cf

  • SHA1

    6de38f45f39789d19b16585de4253305bd7fe37f

  • SHA256

    ed3d51d8d09ff9f79b03d40fb912639f24094280abbf068d861780b5a440545e

  • SHA512

    dbbe11ee848813339c5f3652d934f33348277e43ad5f5e0bcfb0cf9091a163999b40f140a1b49629ba936cf979f4ed42299931eaf440ac780e4f0ade70f05e1b

  • SSDEEP

    24576:UpomTTN9ttttttttttttttttttttttttttttttttttttttttttttttttttttttt3:goo

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2