Extracted

• • Target

    2025-01-28_7b97b647fb60aa732c8453f615c57481_mafia

  • Size

    10.3MB

  • MD5

    7b97b647fb60aa732c8453f615c57481

  • SHA1

    c3c9a7bd49d984c14d3bdb095ee6366d66c1747f

  • SHA256

    9ac7a070c91cb6affd6dd5b52187bb7ea3def59d944eb3efb5702b310295d087

  • SHA512

    8c85c8109d2ea5e212e448b434ff4ced7033377f264b982d192689ef437efc89999ba6f547be4e15e9d8164389cc2c4c33efc3dc0a62823aaade2ec3b9b07ac8

  • SSDEEP

    49152:yqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPa:yqtYc3N

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2