Extracted

• • Target

    2025-01-25_85b00410f90774960ae46efec9f11613_mafia

  • Size

    12.8MB

  • MD5

    85b00410f90774960ae46efec9f11613

  • SHA1

    7712e2db36a26029331d6e509113d042b90cf457

  • SHA256

    336f78a2424aea7feba8ab5cf2ace4dd0f94a6f2c89babf6b80b12ed8d3e1be1

  • SHA512

    b6de80de2e8d45b2ec0bb4b9370325620009841dcc06087162195bead77cb1886f7f5f23435a05d6d1ccd27e551c71d00180830a69f2c1dfdb850cf4afc5210e

  • SSDEEP

    24576:PEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ:Mfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2