Extracted

• • Target

    2025-01-31_7e1d94086970fff96cad7928e9b18a8a_mafia

  • Size

    14.5MB

  • MD5

    7e1d94086970fff96cad7928e9b18a8a

  • SHA1

    af71636d08b7d1036ad238cdae3fe4df2232a063

  • SHA256

    db9bda7c977f649da2c0c5b871f7a459a84f3f56cfdbf422f5c8185f05a31895

  • SHA512

    2f0029a26f9cbeb79b96d2ece5f73ed6308c8c40aa0f08346ad71af5b59b676a84a3ee6043188d832c1f2c65e1b8e256ee3566cd44085856c1f382d7048f0477

  • SSDEEP

    24576:6EfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZb:Tfott

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2