Extracted

• • Target

    2025-01-18_ec9274ec3a47eab2f18150dda32530eb_mafia

  • Size

    14.0MB

  • MD5

    ec9274ec3a47eab2f18150dda32530eb

  • SHA1

    40b5e3794a4c69ea44a5d887121b713cb777125c

  • SHA256

    c1f32d2fa5838080b3f3dae0b79588eab387c8521feeb671ede6470a8c466cf7

  • SHA512

    1128360d6f5b1801df8083c9f56fa5b1d33f49dc57838537884e25e5f297b46b83ec6991bc0066f88b851cbad327a7e42f2477ec4798115637b7fa8d33231fa1

  • SSDEEP

    6144:DLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQ4:4TYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2