Extracted

• • Target

    2025-01-30_8239d411837194c15c188f06ffb1003c_mafia

  • Size

    14.7MB

  • MD5

    8239d411837194c15c188f06ffb1003c

  • SHA1

    4c6edd70541223b1e7792d5e6aa5987200d9efda

  • SHA256

    ddaa428d2e3531994a4902d7a09f248edbc4be2d4fcff8be75f3616439b69707

  • SHA512

    ef6877cba0a22b80a53530f4353065f86967c7fd1548123a860b42d6124e5127bb187a244f81c39f0056b8cf9db5838f23892eca774bfde5950f75241be2e7fc

  • SSDEEP

    393216:GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7:a

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2