Extracted

• • Target

    2025-01-29_cf2e3c0be26450cbab80b728d8789650_mafia

  • Size

    12.4MB

  • MD5

    cf2e3c0be26450cbab80b728d8789650

  • SHA1

    58f4d81c6127d6da8dfde18fdfaa433aba54af12

  • SHA256

    dc7c95788c1c469180356c18a99f3ad1b71f609eabbd51a85966f83f245c252b

  • SHA512

    3f8222faa36a11ab4d0344cc475902d5a482dd58ef4b2922cf536dcc62c076a678fa6ffc34ffbc3b3215709032c790d19ca613b138b09a174756dce656cb974c

  • SSDEEP

    49152:zqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:zqtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2