Extracted

• • Target

    2025-01-31_8b2bfd98f7a67be7cf3cca77f60b2c77_mafia

  • Size

    11.7MB

  • MD5

    8b2bfd98f7a67be7cf3cca77f60b2c77

  • SHA1

    d5137cd797229cf309edaea9e77c9e840d564d7c

  • SHA256

    a8786e809db0f73eb45a3751cc5adeed5a3f298de5e9d79ed1833a4177ed12a5

  • SHA512

    c52a4a295e7dd38d4f6e2f8df7fb73c6fb65ae8776d9acdba53bd1989fad22d86984ada35a193feece095000ae6f9e158cf436e76461b54a39560db31814fe96

  • SSDEEP

    196608:IyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:tXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXn

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2