Extracted

• • Target

    2025-02-01_0e4cf35ce4e14fa62e86c323da9aa4ca_mafia

  • Size

    15.0MB

  • MD5

    0e4cf35ce4e14fa62e86c323da9aa4ca

  • SHA1

    2f61f468f6adf7d5849b7635d125a6fd2c4fbb0a

  • SHA256

    a34fc505581c9d2d8792539af0035776ff2010b061560cc5551844cd927d2733

  • SHA512

    a48d0311381a78ced1dd0c5d1548d83b51d3caa42564124a8bab2c07e3c75ce0c90c50207df4d4a4454138ac4197cb2f3fc5f8f4c36ec47763630edfc7b7e780

  • SSDEEP

    24576:NEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZh:2fot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2