Extracted

• • Target

    2025-01-15_94e3b5b195f4cded12c2a710fb6ba2ac_mafia

  • Size

    13.1MB

  • MD5

    94e3b5b195f4cded12c2a710fb6ba2ac

  • SHA1

    26e8ce9f4c0dde0f214ad1081bfee4a9493ebad5

  • SHA256

    ef89d155d78c35b217e2979635e426216bffc0591e4354ccf760ddb9d5f48fed

  • SHA512

    b132d9ad01a2020ef7c800e8383c0fb0c0e1b3f12a7aa17184bee700778213ba8459b7faec2b5aef60603db8730fb810ad86ce32002c91f0c05079690d8072c2

  • SSDEEP

    49152:qLFuiE888888888888888888888888888888888888888888888888888888888c:qLM

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2