Extracted

• • Target

    2025-01-26_1a0409d9ccf8445c0679060efe550d30_mafia

  • Size

    11.2MB

  • MD5

    1a0409d9ccf8445c0679060efe550d30

  • SHA1

    2aabbbde2e3e1d6f42d6387243a60737ba164222

  • SHA256

    141db036f2473f2aad6ec65e11a5d236404a2a6901f45a7b51fca1fd9ccaa352

  • SHA512

    2c8e95ea2777865b937f70ece6830056db7b5c240b6143f8dc0db9b51413a1e88e0e29563e123c542f9620d1c065c9d3da0d1ea564a896bef3446c538ab806e1

  • SSDEEP

    6144:0LQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQ9:pTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2