Extracted

• • Target

    2025-01-26_a68c1be1027f4baebdbddb4f8e96237a_mafia

  • Size

    12.7MB

  • MD5

    a68c1be1027f4baebdbddb4f8e96237a

  • SHA1

    5f8a6c663aff8f3759cfba2cbccb607685b13ab1

  • SHA256

    123df46c13877e2d95b175eb0dbcc81575e88ac10e977b9908d006b3d5112b6d

  • SHA512

    b99adaeeffabb56637a5a5718ce348f9f6cb45c163d45bd08e1d18dc28b31a9446fe605b48edd94515e1d0500b0ed519cac7680630ea34d56084a964fe222195

  • SSDEEP

    24576:GEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZB:/fot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2