Extracted

• • Target

    2025-02-01_f982d788199c912ddcac30ffc0328afd_mafia

  • Size

    13.9MB

  • MD5

    f982d788199c912ddcac30ffc0328afd

  • SHA1

    954435532bdf44cd2eaac68aa0c18a5cf113fba5

  • SHA256

    395942f0e30f8decdc6526df2831a56bd05b31f94460aa44915edab268b6b50b

  • SHA512

    75b54f91dea775343cd66bc1ab996517522a8967aedcc0d5c7d2b1d7f6229aea1525f66bf0961227fc6dd1d0525ff01733ca4d30388ed90dfcb9cce85b2d23b5

  • SSDEEP

    6144:nLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQV:MTYe+D2jFu+iZoUFhAzQ

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2