Extracted

• • Target

    2025-01-28_88f01df779e44b11a5c92de6ab31f26a_mafia

  • Size

    14.5MB

  • MD5

    88f01df779e44b11a5c92de6ab31f26a

  • SHA1

    d1b06f61901b428b6ad5e8c78cf348722e88daf6

  • SHA256

    a60f03d551fd71fc52fc8bd2483a6c6f20bb7ab187958c1983c1a946edb2c478

  • SHA512

    c2555bf098dbfb72173093361eea38cbf0893bbf2d82292ef52d796c5b9e991af9c473c67a291489862a0789ec1de95e588ae5ffaf6a748513293b0725bf832b

  • SSDEEP

    24576:eEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+:3fotQ

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2