Extracted

• • Target

    2025-01-28_63dcaac1b381fa7e88d8cd2e4cdd8d74_mafia

  • Size

    13.7MB

  • MD5

    63dcaac1b381fa7e88d8cd2e4cdd8d74

  • SHA1

    c30c822977803bfab85a9ff37961517bd74c8311

  • SHA256

    e1df3fe8c0ae2b0705699516b26e6cc71c741e05c56922378d1a0c608d8c399c

  • SHA512

    484379fcf1f922c65e2bbd8ad204344fe11422e3f3bf6d5959b2d84c3efae0945a66175b86fd8daa8607f1189022d4cc9cb04752a275af724395a500c1bd6451

  • SSDEEP

    49152:PqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:PqtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2