Extracted

• • Target

    2025-01-13_a115c374f85cd330e596e28fb19c58d5_mafia

  • Size

    10.8MB

  • MD5

    a115c374f85cd330e596e28fb19c58d5

  • SHA1

    3cf1a9e97085f77e1ef564695c7f05acf6c92444

  • SHA256

    e05b97b6d54a7c0bb15a7eb843a41e50a23330367ec06bc96053389c3c8807b4

  • SHA512

    1b089f00086825fef8076246c9a74aefc9125fa2d6d4102d4005ac1cf93e7a9dedc878db654f3bf93cd8f5d0abd078e47c9852906799b957b1a8daf408a624bd

  • SSDEEP

    6144:RLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQ1:yTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2