Extracted

• • Target

    2025-01-25_b15b8103c063ce7a8849f6cc6d196789_mafia

  • Size

    12.3MB

  • MD5

    b15b8103c063ce7a8849f6cc6d196789

  • SHA1

    9a8519bc5fd5b45e88b354ca47a5405e1b54700c

  • SHA256

    52e2c2485a493bbff724c2b84fff5f827c3a44692fa77ed4fb585d6fca9e6f2b

  • SHA512

    48f579b4844f45ba066b64aa542a40e5abdb0b9ce5ee8c94ac4d5c2942391ca0a021aa6cf6bd3a04da260a6c3a6c3baa2f903043127b72860fb2af634d9d0487

  • SSDEEP

    24576:R6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ3:4WdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2