Extracted

• • Target

    2025-01-22_49340c3d7ab1f049b2399e5733052382_mafia

  • Size

    11.5MB

  • MD5

    49340c3d7ab1f049b2399e5733052382

  • SHA1

    6ebbae3f19bc5219e9f534f90b45acd05cd34715

  • SHA256

    8ca0c45c5ad2a3699ddfd096c361372a5a8a76ccb1303c51ba6dd03f21541fde

  • SHA512

    1b192462ce35161b2285123c1c9177ac16e5b967f53dd90d750d8ba2f287f0b2555355a4f9fa6ff5cc570bb6a57db7116175886ecab426a59fec27d1fadc3baf

  • SSDEEP

    24576:t6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQn:cWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2