Extracted

• • Target

    2025-01-31_0472e8ee3b50ba271bfee33f7f519f5c_mafia

  • Size

    13.7MB

  • MD5

    0472e8ee3b50ba271bfee33f7f519f5c

  • SHA1

    acaff98b09112f8bec1eb8a467be8e4470cd57a1

  • SHA256

    6650fa6e68ec71fbcd05204f13788abb76b1ffd8e168895df0f52dedf8ccacfd

  • SHA512

    48bbae0d5f655c20e9a64e857d57b38adc30d9dceac10cd66b041f9fcc7c6d8bca2adb63c1aff5eb4dbedb33e1091c25b6b01e044eaed5ca74fe561e26c10223

  • SSDEEP

    6144:jLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQ7:YTYe+D2jFu+iZoUFhAzo

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2