Extracted

• • Target

    2025-01-13_3b455b31246b8a9a6548681d39c5fb5d_mafia

  • Size

    11.2MB

  • MD5

    3b455b31246b8a9a6548681d39c5fb5d

  • SHA1

    822afd920a826ff81013822285e6e82fe81bf076

  • SHA256

    c878285d30d32d75b6ed5a17f5ef3ce3fd264ac4ad367264e32b81dab57ee549

  • SHA512

    83290f9a90590015df1f3e0a3643cc98e02998ea38ba2f3dbfd3c9832bbb19465e7503a98cdaab13c1c866796cc2ef5fe870f8961043825194f391bc20750df3

  • SSDEEP

    6144:nLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQw:MTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2