Extracted

• • Target

    2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia

  • Size

    11.5MB

  • MD5

    a9c3ea43e06977ad555eb78862b88c6f

  • SHA1

    708c3d914d5451c0de012dc4278fdce821b7ddc9

  • SHA256

    a7487a3d8d60ef88ef6c8ba1b5b49d453564fc1079c2c5cf8536b6582b5b12f9

  • SHA512

    d668c2bd9caf218997c00de69b1e0d264db188d121f5e1cd5d1770498d267335444c12298c3b3c183c9148b85ac1d163dd4be7b0852349707f44f8de1dbd7ba3

  • SSDEEP

    6144:jLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQw:YTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2