Extracted

• • Target

    2025-01-31_387afac071bccec0be9c8e49d461568d_mafia

  • Size

    12.5MB

  • MD5

    387afac071bccec0be9c8e49d461568d

  • SHA1

    eadafb725052b1eeb3fb3ca0da541c1c600bf663

  • SHA256

    98ee15b4498267f85a08ef3f1d58fe63f8e6e5373e16790be65be707b0eb21e5

  • SHA512

    38235ab069954d83ea6def71c6dbf7c7c45d9406b0eb302502dab05da2ff71951698206b60af52fa0f42e82f9d9f11b54a45cda63349f066eafec1c030c55401

  • SSDEEP

    393216:8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXR:a

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2