Extracted

• • Target

    2025-01-30_8bdbca894376b8c9a864ac11879ddb58_mafia

  • Size

    12.8MB

  • MD5

    8bdbca894376b8c9a864ac11879ddb58

  • SHA1

    8edf0912d7a6574770ec52d56d89ced568d5c5ab

  • SHA256

    0fa9658a9944e2a5fd88eb5fa7b9bd44cd065257f3aeaac1e645566f0fecd131

  • SHA512

    974fbcdeaf2219b4fe8fcb4e95e740dbb705c6f8460147fd8f73f073fd387c0d70127a2bc9ed989310ddee9d21e2a1c4b1d319435dd73ce0c1ca364386a6690f

  • SSDEEP

    49152:dqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:dqtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2