Extracted

• • Target

    2025-01-31_0bc24556871b43248cc95e8fa707217d_mafia

  • Size

    13.8MB

  • MD5

    0bc24556871b43248cc95e8fa707217d

  • SHA1

    1d6f337f491d57265393cdc0d5bd8bd6757281de

  • SHA256

    d1f8162cc1d9a27ebd286bb30b0bc208bd395d26dd859be6635a071f0bc8940b

  • SHA512

    adb5ba1a2e4dd6e90d4b615ed72e0c530435437291cb37a3a99a2c7c2b3f72b552c1ea0583bb6dc32e2df4c84e54bccf68663f687ce1f3919ff3cf9257ca53d1

  • SSDEEP

    49152:BqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPn:BqtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2