Extracted

• • Target

    2025-01-24_43a80b8b886a686d81d1d75ae7a660c0_mafia

  • Size

    12.2MB

  • MD5

    43a80b8b886a686d81d1d75ae7a660c0

  • SHA1

    2599837bcc0f0c22909ca28c5bf04da844b48433

  • SHA256

    0652a5f8a2fffb7fd3ce53a5895c5a550b2d755825e6a70369aee019cedb33c3

  • SHA512

    8d4ed21b7c40fe3df69de4f45ae94578f0fc0e6648337d2be0c1aaeac84f3181c895f25fa420ae98e280d6a118fa9d0825923fb72c063180467dbfd5e571535e

  • SSDEEP

    24576:sEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZD:pfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2