Extracted

• • Target

    2025-01-13_1f4a4a6b40d626bd540eb7d712674869_mafia

  • Size

    10.7MB

  • MD5

    1f4a4a6b40d626bd540eb7d712674869

  • SHA1

    50d3ab9cd6af07bb228319c1b11bd2880d6c2a61

  • SHA256

    63438e509a8a7f7123a45b73eed3ffe053ccf822bb846c910489aaa09cf4ff5c

  • SHA512

    da9e39aaeebb6c3029cdccf4781545f833b41351560f8e22311c21d84503f958e2d9c5a4e28504b01ac7952d1423da14b0b93ccadacd2c5bbc1f65cce61a29d8

  • SSDEEP

    24576:HpomTTN9tttttttttttttttttttttttttttttttttttttttttttttttttttttttv:Joo

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2