Extracted

• • Target

    2025-01-25_07136c6c2b2c098e614be421dc1f638b_mafia

  • Size

    11.4MB

  • MD5

    07136c6c2b2c098e614be421dc1f638b

  • SHA1

    92af92900994707b8b6d4e9ef06cd0011cb01452

  • SHA256

    db59034e8634366a2f6b7f8a6c91399beb14ad5be0f12e309de7e805963b9b3c

  • SHA512

    46b59ba652e164599319f6cfa67f5ac5dca618fde602bd9de8dc80626275e9997ae3c5ab89b406db67aa68fa9f501445b6e24b065fda7dff03586594481aa979

  • SSDEEP

    24576:l6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQw:kWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2