Extracted

• • Target

    2025-01-15_ca8ee4733e7ba78b415231884f389a1b_mafia

  • Size

    10.8MB

  • MD5

    ca8ee4733e7ba78b415231884f389a1b

  • SHA1

    74754a1e264173cfdf792bcb0c9457d10ff7e2a7

  • SHA256

    ac2dbc87f1ab034db4bf8ff17f8497df23f198c8fc76e397a05137cbd768cb87

  • SHA512

    b472b23c4564247fa06807a70c94b779646e3089754cb564d277e23681620e0115ce3cbd7a737648ebb40ee3f9a9f3985c5bd510d8077f18a8de4ea3a1e1edf8

  • SSDEEP

    49152:/LFuiE8888888888888888888888888888888888888888888888888888888883:/LM

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2