Extracted

• • Target

    2025-01-31_b34a84dd7a753b36f32f5044f624e252_mafia

  • Size

    13.7MB

  • MD5

    b34a84dd7a753b36f32f5044f624e252

  • SHA1

    ee3fa3f6f0c043e0af87785fe53dcf81855cd7d8

  • SHA256

    f447757c7f775ff8ddc127a32d64912013b05e9075980a8c52135a9d00025041

  • SHA512

    fc7f391ef38890a3e0118b32f508f956f4813cf438171bfdece3fbac9f7653591a182c1cd44e1a98ecf63fd45fde03ad8acf1b5c3fc8f71c893844f436070440

  • SSDEEP

    24576:LEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ7:Yfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2