Extracted

• • Target

    2025-01-28_8f4cc5d53c74381f6965e9e347365f0b_mafia

  • Size

    11.3MB

  • MD5

    8f4cc5d53c74381f6965e9e347365f0b

  • SHA1

    c13e51d4f50ac41b639648641108afe915d9e945

  • SHA256

    111c30438a1de702ec2c0b7ad1c0a000bde2f229964d3fe46142050e647243fd

  • SHA512

    9e4978298b3e20dd8bfac43469cd2c1d98470c88f6347f268c7181957b713549434053dc20f5969f4a160947f931ac524e554fb31fda6a912da25929c40f7981

  • SSDEEP

    49152:aqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPZ:aqtYc3k

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2