Extracted

• • Target

    2025-02-01_4693eebab2f0d0905d6bc962b3243ff7_mafia

  • Size

    10.8MB

  • MD5

    4693eebab2f0d0905d6bc962b3243ff7

  • SHA1

    e516672eddb46d806493e9c917d5a30f52603cc6

  • SHA256

    6f22c8dc2465a76e36a0c03c271309309c86d009dfe2d5158229a52c9ecd8401

  • SHA512

    e91d1b2c07a8aaf6743addd740ecb9a662df8a037763c02fac2ed84e778609c43981acd7a3190e7b3702c0ec1bbee4bf87c0faecfb02937f519f4f501881f2ab

  • SSDEEP

    196608:pyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:kXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2