Extracted

• • Target

    2025-01-29_38a226e27ea670bcda1d696d31180d0e_mafia

  • Size

    11.7MB

  • MD5

    38a226e27ea670bcda1d696d31180d0e

  • SHA1

    05b0084bd2fe7a9ebcf43d13b394d71d7e41cbd9

  • SHA256

    0057487f203f8cef19e5359b19b2c7ce04933cb01c762409115847e976aaa274

  • SHA512

    2578cd17242c6d5d1b7c3c367b33480a33857d9596d78088fcfe5ae8959b2264826446ffdc16d508ad23eaac18673a2d8ecb6003dff9f4c6c933541a2667b7f4

  • SSDEEP

    24576:06WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ2:ZWdLQks

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2