Extracted

• • Target

    2025-01-31_19d42f70cf2a641da8785c91e58511dc_mafia

  • Size

    13.7MB

  • MD5

    19d42f70cf2a641da8785c91e58511dc

  • SHA1

    f5586aeaf12a883d755b214f70651cdd74b574b2

  • SHA256

    d42784f3215554b90c84380cbaec443685eeb15b109d170a935a7d6352bf66a3

  • SHA512

    5e565ed3a87500568d4e9c79d72632844e45794b211b807e7a154a9380e073ee9969c8b046e5c4d06425d4370b9f6281b8674aa84412834ccdd43a09b1fac6a5

  • SSDEEP

    3072:FLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:oOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2