Extracted

• • Target

    2025-01-29_d843097807b69f23d9e9b92c78a6aef6_mafia

  • Size

    12.7MB

  • MD5

    d843097807b69f23d9e9b92c78a6aef6

  • SHA1

    b169759391428e792bf917b88eac0d08a96a2e0d

  • SHA256

    71c8fa2e70bca29e60ee2f1dfcf36248aee5b23025b4aec2ecb20e5954a434d7

  • SHA512

    76fd4d1f5fb81d17e25ae675b29c5f947ab87c6a26250e29ec07bb821ea0310b7ed1d98d90e56da95968aef0fb821aa9632391d1d33ba05c1823331eaa8d0674

  • SSDEEP

    3072:4LBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:1OMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2