Extracted

• • Target

    2025-01-31_94b08ae45d710b4d9c2971a2c313d6d0_mafia

  • Size

    12.9MB

  • MD5

    94b08ae45d710b4d9c2971a2c313d6d0

  • SHA1

    64ee86c9a7b1d8c8571f16742886ab61d3869a1c

  • SHA256

    0122c61b7744339ff20a0da34326fe959bbedb86067ff115497dea005ab05e77

  • SHA512

    46c2df829a2eed6e8e9740aded9f88cb90689a4f92626d7f6448531c6c69a1f5caa7caf7d3f33d13d58af027fe46affc9f6e2d2d190f6b362d73e191a3508706

  • SSDEEP

    49152:XqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPO:XqtYc3/

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2