Extracted

• • Target

    2025-01-21_eaaa33fba165a45395a43fc7ec05b1bc_mafia

  • Size

    14.6MB

  • MD5

    eaaa33fba165a45395a43fc7ec05b1bc

  • SHA1

    4ab77efaa1c8ad37cd8c605fb684d467f06d0db4

  • SHA256

    14eb214a2f3fb3385fdc544cfeda6fbcccab2af6728b58683f53a597b9260e6d

  • SHA512

    7d01895d08632def6e9d8bdbdedee9853be716c03b20be6b296ad1141c442d461d5f5c83fc4ef7def960bb6cf357d8848d3148ee38c4af60bc53fd3dac625e14

  • SSDEEP

    24576:cEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZl:Zfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2