Extracted

• • Target

    2025-01-31_b4225293c2f943563c10072c131c3b29_mafia

  • Size

    12.3MB

  • MD5

    b4225293c2f943563c10072c131c3b29

  • SHA1

    5000ce755f6a7ca77cfc63cc623a66d600d0633f

  • SHA256

    0406050c5a7682f4f7ff1f2ef234b7845e20b523678902da08aa3e30b4bd37b9

  • SHA512

    12158bf3299a445b375274c04fb9b47c46445885775f86a739279ae98797cc2029f9c56308984b098f5060096e1c956309d159c845c8cd20c495a24247e32fa8

  • SSDEEP

    393216:5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXf:9

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2