Extracted

• • Target

    2025-01-31_220d68c1d332753c1d9bb34d47f66739_mafia

  • Size

    10.1MB

  • MD5

    220d68c1d332753c1d9bb34d47f66739

  • SHA1

    446daa197e7347902249fbac629ab9d132afd08b

  • SHA256

    d89b5b4cb51017fe20af1e97e2e361750e9fcdc287b7fce99065b552226497af

  • SHA512

    bacc9c6342c1beb70bf7832e45b2280d815021d1cee45ea8f91846c2e80c1b2291babe4c91b2569ec8405c982d7997fcc430d7004bfcff9dfcb26dd287c8f6fb

  • SSDEEP

    24576:MEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZd:Jfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2