Extracted

• • Target

    2025-01-30_97072ca9a6e4bdd9766dc25e6464f8d4_mafia

  • Size

    13.7MB

  • MD5

    97072ca9a6e4bdd9766dc25e6464f8d4

  • SHA1

    42c0c68ec982a1587c9a8f82f0f68e229d8161ea

  • SHA256

    7ce2a4327048c6c6bec3d924d83293b98e2e29efd3bcab4bc199f4ed211416d1

  • SHA512

    86b3f0b55be16f466f442a52efbd7d16f1447acfece6028efb74c46dedf137c5ea4086b8c3a6c848db23ed3dd6d0dd74918abfc10f2f2f5edd12b85c95905afd

  • SSDEEP

    49152:PqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP7:PqtYc3m

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2