Extracted

• • Target

    2025-01-25_5349a8ef8ca967bde36d9261ed712f15_mafia

  • Size

    10.3MB

  • MD5

    5349a8ef8ca967bde36d9261ed712f15

  • SHA1

    cb38207ee1430bc4781a7b2f0d25c3605bea3fa2

  • SHA256

    4788a7c613284b815b02b29660d175a940ed28822171bf0b4f145404b35a8dd2

  • SHA512

    9e558a7835df822e240f690fbfacc7bf94bf94602d43419c3afa6a903d08ec2d0a7985e5537338636bf2950344b5f646cf6fc4c698b2f42b08e5c6ee6d1ec440

  • SSDEEP

    24576:UEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZb:xfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2