Extracted

• • Target

    2025-01-31_479648eb2561691a81eb4c5a850e48a0_mafia

  • Size

    11.4MB

  • MD5

    479648eb2561691a81eb4c5a850e48a0

  • SHA1

    4d3d825f85dcb0901a219add3176a686fdc6a72b

  • SHA256

    b147e4cc2fce55d970a4a30890b0818c0b46cc33fd16cb0f33451d2ff50c4baf

  • SHA512

    6214f07b23740e4204c3b6e9b20b5e76098a7fd4164d9491965a2427eb3817bec29e3a9642bea673b8128bd4e029d4c84b50bd099530238fab8baab21c5a4dd1

  • SSDEEP

    49152:0qE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPn:0qtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2