Extracted

• • Target

    2025-01-27_b66d44938c2394f1cb57e53646b2462d_mafia

  • Size

    12.5MB

  • MD5

    b66d44938c2394f1cb57e53646b2462d

  • SHA1

    e15dfebc9e91b04811f437dc6c794ac95dd138fa

  • SHA256

    5cef4a944d765e8174b066cf8141284a903cac39f8599c705e3591a5b32822be

  • SHA512

    eecdd062db81a76dd728f6fb691ca165e96cd9214db8190b47a1a1048b5991f7aa9e95cf00af7757b140af4d1b0869f305c3a65cfb2fc1055da9b080ed7e1c9c

  • SSDEEP

    393216:RXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXm:0

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2