Extracted

• • Target

    2025-02-01_911cc5e56fb7367da1798a04b9c370fb_mafia

  • Size

    12.9MB

  • MD5

    911cc5e56fb7367da1798a04b9c370fb

  • SHA1

    995550c02c0e2f934005d26ab82fde7da37fad1a

  • SHA256

    afd0a3a9ccf343cb2715dee65320a086f810802051a81f39bca3838280cc96fa

  • SHA512

    8e165e186b8520569c36c653c196e1526b8eaf27b9e5995611fff386d42a85ac33cc970efe87e48cb7e307f139d787ff5faab24337342fe6a51b0045e251d144

  • SSDEEP

    6144:oLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQl:9TYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2