Extracted

• • Target

    2025-01-28_93d328ce806b0e10732db6e1c580f90e_mafia

  • Size

    10.1MB

  • MD5

    93d328ce806b0e10732db6e1c580f90e

  • SHA1

    246190637b0b3f7ca01f3a1a9ef2ff8ed5f059a6

  • SHA256

    5539f6769829f00edb6e335e7c98f6a0a9f4a07cb4ce4b2c0179eb8ca16503da

  • SHA512

    3c5e46c51d380d125d3c080c9e224953adee449401283fb3bddafdaa37e5a2b42f39d3df1c0569aab3c373a40557dc69c9c882db822c6371936156b7861ded27

  • SSDEEP

    24576:OEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZC:nfotM

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2