Extracted

• • Target

    2025-01-28_e18363c0288a27da1ef9a3160cd13647_mafia

  • Size

    12.6MB

  • MD5

    e18363c0288a27da1ef9a3160cd13647

  • SHA1

    1f474ef7b436f090c4d150e81d6c8b4864322352

  • SHA256

    d9f1aa065d50a3ce0aaaeacd90d5c48243b29cab3868d902bce958d4bce4c1bf

  • SHA512

    732863405b5bcdc89d03f299dbf6e90a8dbbdc486b583e48a582d33500c1cdf8a29f043c0aef0feeeec37ea1b12c207d4526ea2ff88da64da14d1884345b282b

  • SSDEEP

    49152:nqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:nqtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2