Extracted

• • Target

    2025-01-25_301e2706dc1fd67d639f69376a24a320_mafia

  • Size

    11.5MB

  • MD5

    301e2706dc1fd67d639f69376a24a320

  • SHA1

    caba62563befc86a8762929a38fdd3f5c346eb48

  • SHA256

    4de67356791f43cec40212ccad04c7d1bf0a3b74d3aa1a5b904d13fb1750ed77

  • SHA512

    06fb8e2a90f93e6068a5d4b9620dc759783d9b6e13f119b63b00706c49b31dcbbe5c7613efedf5c522c11531a1e67970486ff017857a12657b404b18245d86c9

  • SSDEEP

    3072:mLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:POMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2