Extracted

• • Target

    2025-01-29_6023e191fca76dfd81406faa8baf5f42_mafia

  • Size

    11.6MB

  • MD5

    6023e191fca76dfd81406faa8baf5f42

  • SHA1

    5567505ca93a62a91f226d391306bf82a31de7f4

  • SHA256

    ef7cc62b3ccd12433900d89c5f6720c99f30fb54b8f51483c82200baaad1b9ff

  • SHA512

    009b51eab687e9a1d5914914a044290e855a5a7666922cb6012edd370ddf65034792db242155b9833345acf0d982fc9819970b84c69995506cf23adb52e59ea9

  • SSDEEP

    196608:iyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:HXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2