Extracted

• • Target

    2025-01-31_1ceb07b6b28d81b0d1a0292f641d3e34_mafia

  • Size

    11.2MB

  • MD5

    1ceb07b6b28d81b0d1a0292f641d3e34

  • SHA1

    eb3b5aacc5f62f82a0cffd4ebd487b4729335f89

  • SHA256

    7af4167a7e387b421f0f87368d51f7924e983b2e245ad75566ec5b20b3417936

  • SHA512

    d3cc0b7b67b1022c729024f9e7bde8b3b2e8d62c870539eb33e85dac24f6daa06b9d7227516d6c9dafb652df4fee03a7212be96957ba6dbe3d959fc8e2443962

  • SSDEEP

    3072:mLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:POMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2