Extracted

• • Target

    2025-01-27_d8af0d10b9e34488660938c793da32bb_mafia

  • Size

    12.5MB

  • MD5

    d8af0d10b9e34488660938c793da32bb

  • SHA1

    e62ece930116d75b30401b0212bba86b2bf2b8c7

  • SHA256

    98ea3d57064e121e454209ef7c15e6571d4d24a8194e635dfe46df99ef56c0f1

  • SHA512

    76a82f0e82436ada650b639d6a4e4f6f0a899239888de1950f7c8d03a0c8a67b1ca2b035b2825d0f047cfdbd062651d4bdb3bfc3141e603dc9b876de64b7fd68

  • SSDEEP

    393216:8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2