Extracted

• • Target

    2025-01-18_cead6c18b15da4302277a2814979c996_mafia

  • Size

    12.4MB

  • MD5

    cead6c18b15da4302277a2814979c996

  • SHA1

    92d47bde1fa1074b3a2791ee3a20bb07decbe1b0

  • SHA256

    d66356826e5ba8aab27a1ea1adf0178f9074a07d5f2f7c7d8092b870b108842a

  • SHA512

    321641a60f333e7943948917bfc87cfa1e0dea53b422f0cfcbd3121ac8a7e4ee72ab83f3dbbd85726e6e9b5aef3258ba67f692a44c3758081b830c8dae828f3a

  • SSDEEP

    393216:LXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2