Extracted

• • Target

    2025-01-24_6b076874c6200d76d204917cf7c71d9a_mafia

  • Size

    10.6MB

  • MD5

    6b076874c6200d76d204917cf7c71d9a

  • SHA1

    45879ab3bc8fcd0e5e3af42313066f5bc3160cc9

  • SHA256

    338ea31e70c7bf2d624456f598f5e3fab2682d2c488f1640d7cd3edac83eae6b

  • SHA512

    4df0a824f18bc63bde91b77d38b3ce11784a5e8dc668004abacde6bd3d72b1eff8a7c684800b43a922a689400be8f04ba4e1634396a7f70793fa9237677c4dab

  • SSDEEP

    6144:9LQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQ1:uTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2