Extracted

• • Target

    2025-01-31_8fa61cfc9f7112ed8d491983c8ee7a47_mafia

  • Size

    15.0MB

  • MD5

    8fa61cfc9f7112ed8d491983c8ee7a47

  • SHA1

    4b2b603c311985f0ac3878392c9098c1d5206e63

  • SHA256

    eda99cc167fa5b9a559ec9b56994e951836c4b40e348286c2724aa94cdfe25fc

  • SHA512

    7d2f3c88fc6f8cedcea43359c8958f40a05c744577a87c53c815cfc7f48a62171de610ddbc7f5fc551b742c6c7e4fcb23300fe1b93bdf1b074ec17a839863bf9

  • SSDEEP

    393216:HXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2