Extracted

• • Target

    2025-01-13_2913be07cd898b6f938c6c78bc6b17c7_mafia

  • Size

    14.2MB

  • MD5

    2913be07cd898b6f938c6c78bc6b17c7

  • SHA1

    aeef3c0d05dfcca2db6e6488ad90b20950f3fd42

  • SHA256

    1bef5da76b7f21d9c2783f1f6c26d91ef56e48a8e87c074ddcdbdd4eefafc085

  • SHA512

    57328db21f5d2ae41c10e78c3c116a49c943aaae89b3a436e582301bdbd7c8470b62c6a44d1c2a04ef2693a5094b0830ac6a930323c7f9f574d4c27c4dcd810d

  • SSDEEP

    24576:e6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQg:PWdLQk

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2